A "CVV2 shop" is an illegal marketplace that sells stolen card verification values and full payment card data. CVV2 is the three or four digit code that proves a buyer physically holds the card during an online purchase. Legitimate greeting card and gift retailers never buy card data. They collect CVV2 at checkout through a compliant gateway and discard it after authorization.
What does CVV2 mean on a payment card?
CVV2 is the three-digit verification code on the back of most Visa, Mastercard, and Discover cards, and the four-digit code on the front of American Express cards. It is not encoded in the magnetic stripe or the chip, so it confirms the buyer has the physical card in hand. Payment networks require it for most card-not-present transactions, including online gift and greeting card orders.
What is a CVV2 shop?
A CVV2 shop is a criminal storefront, often hosted on the dark web or a hidden messaging channel, that sells stolen card numbers, expiry dates, and verification codes in bulk. Buyers use that data to place fraudulent orders for goods that resell fast, and gift cards are a favorite target because they are easy to redeem. Running one of these shops, buying from one, or knowingly profiting from one is a federal crime in the United States and in most other countries.
Why are gift cards and greeting card stores a target?
Digital gift cards can be delivered by email within minutes, which makes them simple to flip for cash. Greeting card shops that sell both paper cards and gift cards carry high order volume and small ticket sizes, so one fraudulent order is easy to overlook. Chargebacks, not the lost merchandise, are the real cost to the merchant.
How can a small gift retailer block card-not-present fraud?
- Never store CVV2 data after authorization, which PCI DSS prohibits.
- Require CVV2 and the billing postal code on every online order.
- Add 3-D Secure or a similar authentication step for high-risk orders.
- Flag any mismatch between the shipping address and the billing address.
- Watch for bulk gift card orders, rush shipping, and repeated failed CVV2 attempts.
What should you do if your CVV2 is exposed?
Call the number on the back of your card and ask the issuer to block the card and send a replacement with a new verification code. Review recent statements for small test charges, which fraudsters often run before a larger purchase. Report confirmed fraud to the FTC at IdentityTheft.gov and file a complaint with the FBI's Internet Crime Complaint Center.
Is it legal to buy card verification data anywhere?
No. There is no lawful market, licensed broker, or wholesale channel for CVV2 data, and no legitimate supplier will ever offer to sell it. Any site advertising bulk card verification values is committing fraud and may also be harvesting payment details from its own visitors. A merchant that needs card data for legitimate billing must collect it directly from its own customers through a PCI-compliant processor.