No. There is no legitimate market where someone sells CVV numbers. A CVV is the short code printed on a payment card, and it is issued to the cardholder, not to a merchant. Anyone offering to sell you a batch of them is fencing stolen financial data. Buying or selling that data is a federal crime in the United States under 18 U.S.C. § 1029 and a serious offense in most other countries. If you run a greeting card or gift shop and you searched this because you want to take card payments online, the useful part is below. The illegal part stops here.
What a CVV is, and who gets to see it
The CVV is the three digit code on the back of most cards, or four digits on the front of American Express. It exists to prove the person typing the card number is holding the physical card. That is the whole job. Banks generate it, print it, and hand it to one person. No merchant is ever issued a CVV. So when a shop asks a customer to type it at checkout, the shop is checking a value, not receiving an asset it can turn around and sell.
Why merchants never store the code
Payment card industry rules flat out forbid keeping the CVV after a transaction is authorized. Not encrypted, not hashed, not in a spreadsheet, not for a second longer than the authorization takes. The same rule covers the full magnetic stripe data and the PIN block.
- A stored CVV is a liability with no business upside. It cannot be used to charge a card again.
- Holding that data puts a shop outside PCI DSS compliance, which affects card processing rates and can end a merchant account.
- A breach that exposes CVV data brings fines, forensic audit costs, and card brand penalties on top of the fraud losses.
That is why every reputable processor blocks it at the platform level. There is no setting that says "keep the code."
For card and gift shops: selling online without touching the code
You do not need to see or hold CVV data to get paid. You need a processor that handles it and sends you a yes or no. In practice that means a hosted checkout or tokenized payment form, where the card number never touches your server. Add 3-D Secure for an extra authentication step on higher risk orders, and turn on address verification to catch mismatches between billing address and card.
- Use a PCI compliant hosted page rather than a custom form in your own code.
- Keep your PCI DSS self assessment questionnaire current. Most small gift shops qualify for the shortest one.
- Never email, text, or write down a customer's card number, even for a phone order. Send a payment link instead.
If someone offers to sell you a CVV list
Walk away. Those lists are frequently recycled, already flagged, or sold to several buyers at once. Cards get declined or charged back, and the money is gone. More importantly, the transaction itself is the crime, whether or not the numbers work. Law enforcement tracks these marketplaces closely, and payment trails are traceable.
If your own card data was exposed
Call the number on the back of your card and ask for a replacement. Report the incident to the FTC at IdentityTheft.gov and to your local police if money moved. For a small business, report network intrusions to the FBI's Internet Crime Complaint Center.
What actually grows a gift business
Personalized cards, seasonal bundles, fast shipping, and a checkout that feels safe. Customers abandon carts when a payment page looks unfamiliar. A clean hosted checkout with a recognizable card brand logo does more for conversion than any discount code. That is the only kind of selling worth learning.