The short answer
There is no legitimate "CVV2 shop." CVV2 is the three digit security code printed on the back of most Visa, Mastercard and Discover cards, and the four digit code on the front of American Express cards. It exists to prove that whoever is typing a card number actually holds the card in their hand. Real greeting card, flower and gift retailers ask you to enter your own CVV2 when you check out. Sites that advertise CVV2 numbers for sale are trading stolen payment data, and buying from them is card fraud, not bargain shopping.
What the code on your card actually does
Your card number identifies the account. The expiry date and the security code act as a second check at the moment of an online purchase. Card networks designed it this way because a number alone can be copied from a receipt or a database, while the printed code cannot be read off a magnetic stripe. Under the PCI Data Security Standard, merchants and payment processors are not allowed to keep the code after a transaction is authorised, so a shop that asks you to email it or store it in your account profile is already breaking the rules.
Why a normal gift shop asks for it at checkout
A card and gift retailer wants the code for one reason: to confirm the order is coming from the cardholder. That request should appear once, inside a secure checkout form, on a page with an https address and a padlock. A seller who asks for the code in a chat window, a text message, a handwritten order form or a follow-up email is not verifying anything. They are harvesting it.
How to judge a card and gift retailer before you pay
- Contact details that resolve to a real business address and a working phone number, not just a web form.
- Clear delivery windows, substitution policy for flowers and gift baskets, and a returns process written in plain words.
- A named payment processor or recognised wallet option at checkout, rather than a request for a bank transfer.
- Terms and a privacy policy that explain what happens to your data after the order ships.
- Independent reviews across several years, not a burst of five star posts from the same week.
Red flags worth walking away from
- Any page that lists card numbers, codes or "fullz" for sale, whatever the wording.
- Discounts that are far below what the product costs to make and ship, such as gift cards at a fraction of face value.
- Pressure to pay by wire, cryptocurrency, gift card code or peer to peer transfer.
- A checkout that collects your code but shows no order confirmation or reference number.
- Sellers who offer to "verify" your card by asking for the code again by message.
Habits that keep your card safe while gift shopping
Use a virtual card number from your bank for smaller or unfamiliar shops, so the real number stays private. Keep one card for online purchases only and check the statement each month. If a site you have never used asks for more identity data than the order needs, close the tab. When something does go wrong, report the charge to your card issuer straight away and file a complaint with your national fraud reporting service.
FAQ
Is a CVV2 shop ever a real store?
No. A shop that sells the codes themselves is selling stolen data. A real store sells cards, flowers or gifts and asks for your code as part of its own checkout.
Should I ever send my code by email?
No. No legitimate retailer needs it outside a secure payment form.
What if I already paid a suspicious gift site?
Call the number on the back of your card, dispute the charge and ask for a replacement card if the number may have been exposed.
Does a small handmade seller need my code?
Only if they process the card themselves through a payment provider. Many small sellers use a hosted checkout that handles the code for them.