What a CVV is
CVV stands for card verification value. Visa calls it CVV2. Mastercard calls it CVC2. American Express prints a 4-digit code on the front of the card. The code sits near the card number and expires with the card.
The code exists for one purpose: to show that the person typing the card number holds the physical card. A merchant that asks for the CVV during checkout gets a signal. The signal is weak. It does not prove the buyer owns the card.
Why CVV shop listings are fraud
A search for "buy cvv shop" returns sites that sell card numbers, expiry dates, and CVV codes. These are stolen records. Sellers take payment in crypto and disappear. Buyers face charges under 18 U.S.C. 1029 in the United States and similar statutes in other countries. Card networks block the numbers. Most of the data on sale is already dead.
Card-not-present fraud at gift shops
Greeting card and gift retailers sell items that ship fast and resell fast. That profile attracts fraud. Common patterns:
- Large gift card orders with mismatched billing and shipping addresses.
- Several cards tried in minutes from one IP address.
- Rush shipping to a freight forwarder or a vacant address.
- Orders placed in peak season, when manual review queues are long.
Controls that work
- Require the CVV and check the AVS response code. Decline on a full mismatch.
- Set velocity limits per card, per email, and per IP address.
- Hold gift card orders above a set value for manual review.
- Use 3-D Secure on high-risk transactions. Liability shifts to the issuer.
What shoppers should do
Never send a CVV by email, chat, or text. No legitimate shop asks for it outside a checkout page. Gift card scams often ask the buyer to read the numbers off the back of a card. The FTC lists these as a top fraud category. Treat any request to buy gift cards as payment for a debt, a tax bill, or a prize as fraud.
A card issuer replaces a compromised number at no cost. Report unauthorized charges within 60 days to keep full protection under the Fair Credit Billing Act.