No, you cannot buy CVV numbers online from any legitimate source. A CVV belongs to the cardholder and the issuing bank, so anyone offering them for sale is trading stolen payment credentials. In the United States, 18 U.S.C. § 1029 makes it a federal crime to traffic in card numbers and CVVs, and the UK, Canada, Australia and EU member states have comparable statutes.
This page explains what the code is, why every listing that promises to sell you one is a dead end or a trap, and how to protect your own card when you order gifts and greeting cards online.
What a CVV is and where it lives
A CVV is the three digit code printed on the back of most Visa, Mastercard and Discover cards, or the four digit code on the front of American Express cards. Banks issue it to prove that whoever is typing the number is holding the physical card. The code is not stored on the magnetic stripe or the chip, which is why phone and online merchants ask for it as a second check.
Card networks call these transactions "card not present" because no card is swiped at a terminal. That gap is exactly what makes CVV data valuable to criminals, and why banks treat leaked CVVs as a serious breach.
Why "CVV shops" fail on every count
Forums, chat channels and throwaway sites that advertise CVV sales share the same pattern of problems. A buyer sends money first, and the seller has no reason to send anything back.
- Your payment disappears. Sellers take crypto or gift card codes because those transfers cannot be reversed. There is no refund process and no customer service.
- The data is dead on arrival. Banks void a card as soon as fraud is flagged. A large share of numbers offered for sale were cancelled weeks earlier.
- You are buying someone's identity. Each CVV pairs with a real person's name, address and bank account. Using it harms a stranger.
- Traps are common. Some "shops" are run by scammers who collect buyer details; others are run by investigators gathering evidence.
- Fraud tools watch the attempt. Issuers score every card not present order. An unusual name, address and card mix triggers a block and a fraud case.
None of this is a fair trade. The seller risks nothing and the buyer risks money, data and a criminal record.
The legal side in plain terms
Buying, selling, holding or using another person's card credentials is a crime in most countries, even if the card is never charged. Prosecutors treat possession of bulk card data as evidence of intent. Penalties in the US reach fines and prison time, and card networks ban offenders from holding merchant or payment accounts for years.
If a purchase on a stolen card succeeds, the chargeback lands on the merchant, not the bank. For a small greeting card or gift shop, one fraudulent order can wipe out a day of sales, plus a chargeback fee on top.
How to keep your own CVV safe when you order online
Card safety starts with habits, not software. These steps cut your exposure when you buy gifts, flowers or cards from any retailer.
- Type card details only on sites with a padlock and a real business address, and check the domain spelling before you pay.
- Never send a full card number and CVV by email, chat or text. Legitimate shops use a payment page, not a message thread.
- Use a virtual card number from your bank or a payment service for one off purchases. Each number can be capped and retired after use.
- Skip saving cards in browsers and shopping apps on shared or work devices.
- Review statements each month and turn on instant transaction alerts.
- Freeze your card in your banking app the moment something looks wrong.
One more habit worth keeping: be suspicious of any seller, including a gift seller, who asks you to pay with gift card codes or crypto. That request is a fraud signal on its own.
What to do if your card data leaks
Call the number on the back of your card and ask for a block and a replacement. Report the loss in writing so the dispute record is clear, then review the last few statements for charges you do not recognise. In the US you can file a report with the FTC at IdentityTheft.gov and with the FBI's Internet Crime Complaint Center at ic3.gov; other countries have national fraud reporting bodies.
Change the password on any shopping account that stored the card, and check whether your email address appears in a breach notification. Speed matters here, because most consumer protections shrink once you delay.
Questions people ask
Is buying a CVV ever legal?
No. There is no consumer market for other people's CVV data. The legal way to obtain a card number is to open an account with a bank or use a virtual card issued in your own name.
Are virtual card numbers a safe alternative?
Yes. Banks and payment apps issue single use or merchant locked numbers that carry their own CVV. If the number leaks, the damage stops at that card.
Do gift and greeting card shops need my CVV?
A shop needs the CVV tied to your own card when you pay for an order. No shop needs it for a card you do not own, and no shop will ask you to read it out in a message.
What happens to the merchant when a stolen card is used?
The merchant loses the goods and the money, plus a chargeback fee. That is why gift retailers run address and CVV checks and flag orders that do not match.