What a CVV dump is
A CVV dump is a batch of stolen payment card records offered for sale. "CVV" is the card verification value: the three digits printed on the back of most Visa, Mastercard, and Discover cards, and the four digits on the front of American Express cards. The word "dump" comes from magnetic stripe data, which card writers copy in bulk. A record inside a dump can hold the card number, the expiration date, the cardholder name, and in some cases the CVV.
Why the CVV changes the price
Card networks treat the CVV as a check on card-not-present orders. A merchant that asks for it can compare the answer with the issuer. A stolen card number alone fails that check. Dumps that include a CVV therefore sell for more than numbers alone, which is the main reason the term exists as a category.
Legal status
Buying, selling, or using a CVV dump is a crime in most countries. In the United States, 18 U.S.C. § 1029 covers fraud tied to access devices and sets prison terms of up to 10 years for a first offense and 15 years for some repeat offenses. The UK Fraud Act 2006 covers the same conduct. Possession with intent to use is enough under both systems.
Card protections that reduce exposure
Chip cards generate a one-time code for each transaction, so a copied number stops working. Tokenization replaces the card number with a substitute value for stored payments. 3-D Secure adds an issuer check at checkout. Each of these lowers the resale value of a static dump. Card networks do not publish loss figures split by dump sales, so the size of the market is not public.
If your card data is exposed
- Call the issuer and ask for a block and a replacement card.
- File a report at IdentityTheft.gov, run by the Federal Trade Commission.
- Report the incident to the FBI Internet Crime Complaint Center at ic3.gov.
- Read statements for small test charges, which often come first.
A gift card or greeting card purchase that arrives with an unknown charge on the same statement is a common first sign. Keep the receipt and the card number for the dispute file.