The short answer
A CVV dump is a batch of stolen payment card details that someone is selling. The name mixes two bits of carding slang. A dump is the data pulled off a card's magnetic stripe, often from a skimmer or a breach at a retailer. CVV is the card verification value, the three or four digit code printed on the card or encoded on the stripe. Sellers bundle those details into lists and move them through forums, chat channels, and private markets. Buyers then spend the numbers on real orders, and those orders land on real stores.
Why a greeting card or gift shop ends up in this story
Gift cards sit close to cash. A stolen card number can buy a hundred dollars of gift card balance in one transaction, and that balance can be resold within minutes. Digital gift cards make it worse. There is no package to intercept and no shipping delay to catch the fraud before the code is spent. I have seen small card shops take a wave of hits over a single weekend, with dozens of orders for the same denomination going to a handful of email addresses.
Greeting cards themselves carry less risk, but the checkout page is the same page. If your shop stores card numbers or runs on a plugin you stopped updating two years ago, that is the door someone walks through.
Red flags I look for in orders
- Several gift cards in one order, all at the top denomination.
- Billing address in one country, IP in another, delivery by email.
- Two or three declined attempts, then one approval on a different card.
- A new account with no browsing history that checks out within a minute of signup.
- Free email domains with random strings, or addresses that differ by a single character across orders.
- Orders clustered between 1 a.m. and 5 a.m. in your time zone.
What actually reduces the damage
- Require the CVV on every transaction and never store it after authorization. PCI DSS is explicit on this point.
- Turn on 3-D Secure or your processor's liability shift option. It adds a step for the buyer and moves most fraud loss off your books.
- Set velocity limits per card, per email, and per IP address.
- Hold digital gift card delivery on high risk orders and call the buyer before you send the code.
- Keep AVS checks strict and treat a mismatch as a stop, not a warning.
- Patch your storefront and scan for injected scripts. Digital skimming is how a lot of this card data leaves a small shop in the first place.
If you think you have already been hit
Pull the order records, note the IPs and timestamps, and void any gift card codes you can still void. Call your payment processor the same day. Report the incident to the FBI's Internet Crime Complaint Center, and file with the FTC if customer data was exposed. Chargebacks on card not present fraud often arrive 30 to 60 days later, so keep that evidence file intact and labeled.
What not to do
Do not buy, sell, test, or check a dump, even out of curiosity. Possession and use of stolen card data is a crime in most jurisdictions, and the markets that peddle it are the same ones that rob the people who visit. There is no safe side of that trade. If you want to understand fraud so you can defend against it, read your processor's risk guide instead.