A CVV2 shop is an illegal marketplace that sells stolen payment card data, including the three or four digit security code printed on the card. Buying from one is a crime in the US, the UK, and most other countries, and the data sold there fuels card-not-present fraud. Real gift and greeting card stores never sell card numbers, and no honest business needs your CVV2 outside of the checkout page.
What does CVV2 mean on a payment card?
CVV2 is the three digit code on the back of most Visa, Mastercard, and Discover cards, and the four digit code on the front of American Express cards. It sits near the signature strip and proves that the person typing the card number holds the physical card. Online checkouts ask for it because a card number alone is easy to steal and reuse.
CVV2, CVV, CVC, CID: what is the difference?
- CVV2 is Visa's name for the code, and the term became the general label for all of them.
- CVC2 is what Mastercard calls the same code.
- CID is the American Express version.
- CVV1 is a different code stored on the magnetic stripe and read by a card terminal, not by a website.
What gets sold in a CVV2 shop?
A listing pairs a card number with the expiry date, the cardholder name, a billing address, and the CVV2 code. Sellers sort them by country, card brand, and credit limit, and want payment in cryptocurrency. Some of these sites are bait: they take the money and send nothing.
Prices stay low because stolen card data trades as a commodity. One card record can sell for less than the price of a greeting card, which tells you how little the seller values it. Volume is the point, since a shop only needs a small share of its buyers to cash out before the cards get blocked.
Why is "CVV2 shop" a warning sign?
The phrase describes fraud, not retail. A shop that deals in greeting cards, flowers, or gift boxes sells products, not card credentials. If a site advertises card numbers for sale, close the tab and do not enter payment details.
How do legitimate gift and card shops handle CVV2?
A gift shop that accepts cards follows the PCI DSS rules set by the card networks. The checkout collects the CVV2, passes it to the payment processor with the transaction, and drops it. Keeping the code after authorization is banned, and merchants that store it risk fines and the loss of their ability to accept cards.
What a real shop does with your CVV2
- Asks for the code once, on the payment page.
- Sends it to the processor along with the order total.
- Keeps it out of databases, order notes, receipts, and email.
- Never requests it by phone, chat, or text after you pay.
Why a second request for your CVV2 is a red flag
No honest checkout asks for the code twice for the same order. A second request means either a phishing page or a shop with broken payment code. Close the page, then check your statement for charges you did not make.
How do you check if a gift shop is safe to buy from?
- Check the address bar for HTTPS and a domain that matches the brand name.
- Look at the payment page for a known processor or a hosted checkout window.
- Read the returns and contact pages. Real shops list a phone number and a business address.
- Pay with a credit card or a wallet that offers buyer protection.
- Walk away from any shop that wants your CVV2 over email.
Why do fraudsters target gift cards and card shops?
Gift cards are a favorite target because they carry value, need no shipping, and can be resold. A thief who tests a stolen card on a small gift purchase learns whether the card works before spending more. That test charge often shows up as a one or two dollar order on your statement.
Card testing also hits small merchants with chargeback fees. A greeting card store that ships a bouquet on a stolen card loses the goods, the shipping cost, and the transaction fee. This is one reason shops add address verification and 3D Secure checks at checkout.
What to do if your card data appears in a CVV2 shop
- Call the number on the back of your card and report the leak.
- Freeze the card in your banking app while you wait for a replacement.
- Ask for a new card number, not just a new piece of plastic.
- Read three months of statements for small test charges.
- Report the fraud to your national consumer protection body.
In the United States, the Fair Credit Billing Act caps your liability at 50 dollars for unauthorized credit card charges when you report them. Debit card protection depends on how fast you call, so report a leak the same day you spot it.
Frequently asked questions about CVV2 shops
Is buying from a CVV2 shop legal?
No. Buying, selling, or using stolen card data is a crime in the US, UK, EU, Canada, and Australia. Penalties include fines and prison time, and a first offense is still an offense.
Do I need to give my CVV2 to buy a gift card online?
Yes, if you pay with a credit or debit card, the checkout will ask for the code. You skip the request when you pay by bank transfer or from a stored wallet balance.
Does the CVV2 change over time?
The code stays the same for the life of the card. That is why card rules ban merchants from storing it: a leaked number plus a leaked code is enough to spend.
Can a shop charge my card without the CVV2?
Sometimes, yes. Repeat charges on a saved card can go through without the code, which is why you should cancel old subscriptions and read your statements.
Key points to remember
- A CVV2 shop sells stolen card data. It is not a place to buy gift cards.
- The CVV2 code is a fraud check for online payments, not a password to share.
- Honest shops collect the code once, at checkout, and never store it.
- Report a leak to your bank at once and ask for a new card number.