Direct answer
A cvv2 shop is an illegal site that sells stolen payment card data. There is no legal version of this business. The CVV2 is a security code that proves the buyer holds the physical card. Card issuers and payment networks never sell it. Buying card data, selling card data, or using card data that belongs to another person is a crime in the United States under 18 U.S.C. 1029.
What the CVV2 code is
Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. The issuer generates the code at account opening. The code is not written to the magnetic stripe and not encoded in the chip. A merchant that runs a card-not-present order sends the code to the issuer inside the authorization request. The issuer compares it to the value on file. A mismatch returns a decline.
Why gift shops and card retailers ask for it
Online orders carry chargeback risk. The merchant ships goods before the issuer settles funds. A CVV2 check blocks orders placed with a copied card number and no physical card. Gift shops, florists, greeting card retailers, and gift basket sellers run the same check on phone and web orders. The check rides along with the authorization message. It is not a separate fee line.
What the rulebook says
PCI DSS Requirement 3 classifies the CVV2 as sensitive authentication data. A merchant must not store it after authorization, even in encrypted form. A shop that holds a database of CVV2 numbers is outside the standard or breaking it. Legitimate processors discard the value once the issuer answers.
Why the phrase shows up in search results
Fraud sites use the phrase to attract buyers. Traffic comes from search engines and chat channels. The sites take cryptocurrency and hold no merchant account, so card networks cut them off. The FBI Internet Crime Complaint Center logs complaints about card data sales and related fraud.
The gift card link
Stolen card numbers get used to buy gift cards and prepaid cards. Gift cards resell with no name attached. That makes gift card orders a target. Retailers watch for bulk gift card orders, billing addresses that do not match the card, and repeat attempts with different card numbers.
Steps to take
- Read the card statement each month and dispute unknown charges with the issuer.
- Do not enter card data on a site that sells CVV2 numbers.
- Report the site to the FBI IC3 and the FTC.
- Request a new card number if a merchant reports a breach.
- Keep the CVV2 out of emails, chat messages, and saved notes.
If a card is compromised
Call the issuer. The number sits on the back of the card. The issuer cancels the account and issues a new number. File a report with the FTC and with the FBI IC3. Keep the report number. A police report helps if the issuer asks for one.