What a CVV code is
A CVV is the 3-digit code printed on the back of most Visa, Mastercard and Discover cards, next to the signature strip. American Express prints a 4-digit code on the front. The code is not held on the magnetic stripe and not printed on receipts. It exists for card-not-present payments: phone orders, mail orders, online checkouts.
Why "buy CVV website" listings are fraud
Searches for those phrases lead to forums, chat channels and bots. The goods on sale are card numbers taken from other people. Three outcomes are common. The data is fake or already blocked. The buyer pays and receives nothing. The buyer's own payment details get captured during the attempt. Banks and card networks block number ranges once fraud is reported, so a purchased list has a working life measured in hours, not months.
Legal position
In the United States, 18 U.S.C. § 1029 covers trafficking in access devices. Sentences reach 10 years for a first offense, and up to 15 years in aggravated cases. The UK Fraud Act 2006 and the Computer Misuse Act 1990 cover the same conduct. Buying the data is an offense, not only selling it.
What a gift shop checks before it ships
- CVV result code from the payment gateway. A mismatch means the code typed does not match the issuer record.
- Address verification (AVS) result. Match, partial match or no match.
- Order value and item type. Gift cards and hampers resell fast, so they draw fraud.
- IP country against billing country.
- Age of the email account and its domain.
- Count of orders from the same device in 24 hours.
Parameters that decide liability
Card networks shift chargeback liability to the merchant when the CVV check and the AVS check are not both performed. A shop that runs the code and gets a match keeps a weaker case if it skips the address check. A shop that skips both carries the loss on every disputed order.
Pitfalls
- Storing the CVV after authorization. PCI DSS requirement 3.2 forbids retention of sensitive authentication data once the transaction completes. A shop that keeps CVV values in a database fails the audit and holds the liability.
- Taking phone orders without the code. The chargeback risk moves to the merchant.
- Shipping before the settlement window closes. A chargeback can arrive 120 days after the sale.
- Treating a CVV match as proof of identity. It is one signal, not a verification.
- Buying card data from a seller. There is no recoverable value and no legal route to a refund.
If your card number leaks
Call the issuer. The number is replaced and the old one is blocked. In the US, report at IdentityTheft.gov and keep the report number. In the UK, report to Action Fraud. Card networks do not require a victim to buy anything to reverse a fraudulent charge.