What a CVV2 shop actually is
It is a fraud marketplace. A CVV2 shop sells stolen card numbers along with the three or four digit verification codes attached to them, usually in bulk and often on hidden forums. It is not a payment processor, not a discount gift store, and not a service any legitimate retailer would touch. If you landed on the phrase hoping for cheap merchandise, that is the hook, and the merchandise does not exist.
You will not find a list of these sites here. Naming them would just drive traffic to criminals.
The code itself is dull, and that is the point
CVV2 is the three-digit number printed on the back of most Visa, Mastercard, and Discover cards. American Express puts a four-digit code on the front. Checkout pages ask for it because the code is not written to the magnetic stripe or the chip. Someone who skims a card gets the account number and the expiry date, but not the CVV2. That single gap is what the code is protecting.
So when a stolen card number shows up for sale, the CVV2 is the piece that makes it usable online. That is the whole business model behind these shops.
How a real card or gift shop handles it
- Ask for CVV2 only inside a secure checkout page, never by email, chat, text, or phone.
- Never store it after the transaction is authorized. PCI DSS rules forbid retaining the code, full stop.
- Use tokenization so the card number itself does not sit in your system.
- Check the billing address against the card issuer with AVS, and treat mismatches as a review trigger.
- Watch for order patterns that look off: several cards failing in a row, rush shipping on a big order, or a billing and delivery address in different countries.
Red flags when you are buying a gift
A real shop never asks you to send your card number and CVV2 in a message. It never asks for the code again after the sale, which is a classic phone scam line. It does not push you to pay by gift card or wire transfer. If the price on a designer item is a fraction of retail and the site has no return policy or physical address, walk away.
If your card details were exposed
Call the number on the back of your card and ask for a replacement with a new number. Review recent statements line by line, then set up transaction alerts. In the US you can file a report with the FTC at IdentityTheft.gov, and online fraud complaints go to the FBI's IC3. Keep the paperwork; disputes move faster with a report number attached.
The short version
CVV2 exists to make stolen card data harder to use. A shop built around selling that data is a crime scene, not a store. Treat the phrase the way you would treat any other offer that only works if something is being stolen from someone else.