Quick answer
A CVV dump is a bulk file of stolen payment card records. Each record holds a card number, an expiry date, a cardholder name, and often the card verification value. That value is the 3 digit code on the back of a Visa, Mastercard, or Discover card, or the 4 digit code on the front of an American Express card. Dumps are traded on criminal forums and chat apps. Buying, selling, or using one is a crime. In the United States, 18 U.S.C. Section 1029 covers payment card fraud. A merchant that receives a stolen card number cannot undo the theft. It can only flag the order and stop the shipment.
What a dump record holds
- Card number, also called the PAN
- Expiry date
- Cardholder name
- Card verification code
- Billing ZIP code, in some files
- Issuer bank name, taken from the first six digits
CVV and CVV2
CVV is the term from early Visa documents. On a live card the printed code carries the name of the network: CVV2 for Visa, CVC2 for Mastercard, CID for American Express, CAV2 for some others. PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. That category includes the full magnetic stripe data and the card verification code. A shop that keeps the code in a database, a spreadsheet, or a paper order pad is out of compliance.
Where the data comes from
- Skimming devices on fuel pumps and ATMs
- Breaches at retailers and payment processors
- Phishing pages that copy a checkout screen
- Malware on point of sale terminals
Why gift and greeting card shops are targets
Gift cards move like cash and carry no shipping address. Many gift catalogs deliver codes by email within minutes. Fraud rings use small orders to test whether a stolen card still works. A 2 dollar card purchase that clears tells them the number is live. They then buy gift cards or high value items. Because the order value is low and the product is digital, the chargeback arrives weeks later, after the goods are gone.
Signs of a fraudulent gift order
- Several orders from one IP address in a short window
- Billing address and shipping address in different countries
- A string of declines followed by one approval
- Orders for gift cards only, with no greeting cards
- Free email domain and a name that does not match the card
- Requests to rush delivery or change the address after payment
Controls for a small merchant
- Never store the card verification code, in any form
- Use a hosted payment page or tokenized fields so card data never touches your server
- Require both the code and address verification on every card not present order
- Set velocity limits per IP address and per card
- Call the buyer on orders above a set dollar amount
- Train staff to spot gift card resale patterns
- Keep order logs for at least one year for chargeback evidence
Reporting
Report a suspected card fraud order to your acquiring bank and to the card network. In the United States, file a complaint with the FBI Internet Crime Complaint Center. The FTC accepts identity theft reports at IdentityTheft.gov. If card data leaked from your own systems, notify your acquirer and the card brands under your merchant agreement.