What a CVV dump is
CVV stands for card verification value. Visa, Mastercard and Discover print a 3-digit code on the back of a card. American Express prints 4 digits on the front. The code is a check value tied to the card number and the expiry date.
A dump is carding slang. It means a batch of stolen card records sold as one file, often hundreds or thousands of records at a time. A record carries the card number, expiry date, cardholder name, and magnetic stripe data. Some records list the printed CVV2 code. Many do not.
Why the printed code matters
At a terminal, the chip or stripe supplies a verification value to the payment network. An online shop asks for the printed CVV2 instead. Both checks test whether the buyer holds the physical card. A record with no valid CVV2 or no matching stripe data fails that test.
Payment rules ban storage of CVV and CVV2 after authorization. PCI DSS Requirement 3.2 says sensitive authentication data must not be kept after authorization, even in encrypted form. That limit cuts the resale value of a stolen code.
How this touches a gift shop
Greeting card and gift retailers sell low-value items and gift cards. Stolen numbers get tested on small orders first. A $4 card and a $25 gift card draw less notice than a laptop.
- Card-not-present fraud means no card and no signature at the point of sale.
- Gift cards are a target because a balance moves fast and resells.
- Chargebacks land on the merchant when a cardholder disputes the charge.
Protect a card and an order
- Read the statement each month. Report unknown charges to the issuer.
- Use a chip or contactless tap at a terminal. The chip creates a one-time code.
- Cover the printed code in public.
- Buy gift cards from a locked case or the retailer's own site, not a resale listing.
- Shops: tokenize card data, run address verification, and check CVV2 on every order.
The Federal Trade Commission publishes consumer guidance on card fraud and gift card scams. The FBI Internet Crime Complaint Center takes reports from the public. US cardholders carry $0 liability when a card number is stolen but the card stays in hand, and $50 at most otherwise.