Answer first
A CVV2 shop is a storefront that sells stolen payment card records. The records pair a card number with the three or four digit security code printed on the card. These sites operate outside the law. Selling card data is a crime under 18 U.S.C. 1029 in the United States and under similar statutes in Canada, the UK and the EU. No greeting card or gift retailer sells CVV2 data. A gift shop asks for your CVV2 code to confirm you hold the card, then discards it.
What CVV2 means
CVV2 stands for Card Verification Value 2. Visa created the term. Mastercard calls its version CVC2, and American Express calls its four digit front code CID. The code sits on the back of Visa, Mastercard and Discover cards, next to the signature strip. It is three digits. American Express prints four digits on the front, above the card number.
The issuer generates the code when the card is produced. The code is not stored on the magnetic stripe. It is not written into the EMV chip. A thief who skims a card at a fuel pump gets the number and the chip data, but not the CVV2.
Why shops ask for the code
Card numbers leak in bulk from data breaches. A number alone is often enough to attempt a purchase. The CVV2 check blocks those attempts at most online shops. PCI DSS Requirement 3.2 forbids merchants from storing the code after a transaction is authorized. That rule keeps the code out of the databases that get breached.
What the code does not stop
Fraud rings buy full card records and resell them. A buyer who holds a complete record can pass a CVV2 check. Banks then see a charge that looks normal. The cardholder finds out weeks later on a statement.
How to check a gift shop before you pay
- The address bar shows https, not http.
- The site lists a company name, a street address and a phone number.
- The refund and shipping terms sit on the site, not in an email.
- The checkout accepts major cards and does not demand a bank transfer or gift card codes.
- The price sits close to the price at other shops.
A price far below market is a warning sign. So is a shop that asks for your card number through chat or email. Card networks bar merchants from collecting card data that way.
If your card data is used
Call the number on the back of the card. The issuer can freeze the account and issue a new card with a new number and a new CVV2 code. Report the charge to the FTC at IdentityTheft.gov and to your local police. File a complaint with the FBI Internet Crime Complaint Center if the loss came from an online seller.
FAQ
Can I buy a greeting card with a CVV2 code alone?
No. A shop needs the card number, the expiry date and the cardholder name.
Do gift cards have a CVV2?
Some prepaid cards print a three digit code. Retail gift cards use a separate PIN or activation code instead.