What "CVV2 shop" means
A CVV2 shop is a website that sells stolen payment card numbers. CVV2 is the three-digit code printed on the back of most Visa, Mastercard, and Discover cards. American Express prints a four-digit code on the front. Sellers use the code to prove they hold the physical card during a card-not-present purchase.
Legitimate retailers never sell card data. A site that offers CVV2 numbers for sale is trading stolen financial records. Buying from such a site, or using a card number bought from one, is a crime in the United States, the United Kingdom, the European Union, and most other jurisdictions. Penalties include prison terms and fines.
Why the term shows up in gift shopping
Card testing hits gift shops and greeting card stores. A thief buys a small item, such as a $4.99 greeting card, to check if a stolen number works. The order ships, the charge clears, and the thief moves to larger purchases. Small-ticket gift retailers see this pattern because the dollar amount draws less attention from fraud systems.
How card data leaves a cardholder
- Skimming devices attached to fuel pumps and ATMs.
- Data breaches at merchants that store card numbers.
- Phishing pages that copy a checkout screen.
- Malware on a home computer that logs keystrokes.
PCI DSS, the payment industry standard, bans storage of the CVV2 code after a transaction is authorized. A merchant that keeps the code is out of compliance.
Checks before you buy cards or gifts online
- Read the checkout page. A real processor asks for the card number, expiry date, and CVV2 code on one secure form.
- Check the site address. The padlock and "https" show encryption, not honesty.
- Look for a street address and a phone number in the site footer.
- Pay with a credit card. Credit cards limit your liability for unauthorized charges under US federal law.
If a card number is used without your consent
Call the card issuer and ask for the card to be closed. The issuer removes fraudulent charges and sends a new card. Report the event to the FTC at IdentityTheft.gov and to the FBI Internet Crime Complaint Center. Keep the card and the gift order separate. Do not buy CVV2 data to test a system, and do not send your own code to a person who asks for it by phone or email.