Short Answer
A "cvv2 shop" is a criminal storefront on the dark web or on a hijacked domain. It sells stolen payment card records. Each listing pairs a card number with the CVV2 code printed on the card. Buying, selling, or using those records is card fraud. It is a federal crime in the United States and a crime in most other countries.
What CVV2 Is
CVV2 is the three-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a four-digit code on the front and calls it CID. The code exists to prove that the buyer holds the physical card at the moment of purchase.
Card networks require CVV2 for card-not-present transactions. A phone order, an online gift purchase, or a mail-order greeting card box all fall in that group. A correct CVV2 lowers the chance that the merchant will lose a chargeback.
What These Shops Sell
Listings vary by data quality:
- Card number, expiry date, and CVV2 code
- Full records with cardholder name, billing address, phone, and email
- Bank login credentials tied to the same person
- Gift card numbers and PINs with a balance attached
Reported prices sit between a few dollars and a few dozen dollars per record. Bulk lots run into the thousands.
Legal Status
US law covers this ground in 18 U.S.C. § 1029. The statute targets fraud and trafficking in access devices, a category that includes card numbers and CVV2 codes. Sentences reach 10 years and higher per count, plus fines. The UK, Canada, the EU, and Australia have matching offenses.
Why Gift and Greeting Card Retailers Care
Gift card stock is a frequent target. A stolen card number can buy a gift card, and the gift card can be resold for cash. The merchant absorbs the loss, the chargeback fee, and the shipping cost.
Card networks publish rules that limit exposure. Merchants collect CVV2 at checkout, run address verification, and route risky orders to 3-D Secure. PCI DSS Requirement 3 forbids storing CVV2 after authorization. A shop that keeps the code in a database is out of compliance and a target.
How Shoppers Spot a Bad Offer
- Gift cards priced below face value
- Sellers who ask for payment in crypto or other gift cards
- Anyone who asks for your CVV2 over chat or email
- Storefronts that copy a known brand and change one letter in the domain
If Your Card Data Leaks
Call the issuer and freeze the card. Order a replacement. Check statements for small test charges. File a report at IdentityTheft.gov in the US and at the IC3. Keep the report number for the bank.
About This Site
We sell greeting cards and gift items. Payments run through a card processor. We do not store CVV2 codes, and we do not buy card data from any source. No legitimate seller does.