What a CVV2 shop is
A CVV2 shop is a website that offers to sell card verification values, typically bundled with card numbers, names, and expiry dates. The CVV2 is the three or four digit code printed on a payment card, and it exists so a merchant can confirm the card is in hand during a transaction. Banks, card networks, and payment processors do not sell these codes to the public. Any shop that advertises a stock of them is trading in stolen payment data.
Why no CVV2 shop can be legitimate
The code was designed as a check against someone using a copied card number alone. Card networks classify CVV2 as sensitive authentication data, and the PCI rules that govern merchants forbid storing it after a transaction is authorised. That means the inventory on a CVV2 shop should not exist in bulk anywhere in a legal payment system. Buying from such a site funds card fraud and identity theft, and it places the buyer inside a criminal chain in most jurisdictions.
Signs a CVV2 shop is a scam
- The site asks for payment in cryptocurrency or gift card codes.
- Prices are listed per card, per country, or per balance band.
- Sellers offer a test transaction to prove the data works.
- The domain changes every few weeks and has no company address.
- Reviews appear word for word on several unrelated sites.
These same sites frequently keep the money and deliver nothing, or deliver data that was already cancelled. The buyer has no legal route to a refund, because the purchase itself was unlawful.
How to protect your own card details
- Type the shop address yourself instead of opening links from messages.
- Check that the checkout page uses a secure connection and a recognised payment provider.
- Pay with a credit card or a virtual card number rather than a debit card.
- Keep the CVV2 code out of emails, chat apps, and order notes.
- Review your statements every month for charges you do not recognise.
- Set up transaction alerts in your banking app.
What to do if your card data is exposed
- Call the number on the back of your card and ask for the card to be frozen.
- Request a replacement card with a new number and a new CVV2.
- Dispute each unauthorised charge in writing with your issuer.
- Change the password on your bank account and any shopping account that stored the card.
- Report the incident to your national fraud reporting service.
- Check your credit file for accounts you did not open.
If someone offers you CVV2 data for sale, treat it as a crime in progress rather than a bargain. Report the site to your card issuer and to the fraud authority in your country, then delete the contact.