A site that sells CVV data sells stolen credit card numbers. The CVV is the card verification value printed on the card. Sellers get numbers from data breaches, skimmers, and phishing pages. Buying from one of these sites is fraud in the United States, the United Kingdom, Canada, and most other countries. The buyer also hands payment details to a criminal seller.
What CVV means on a card
Visa, Mastercard, and Discover print three digits on the back of the card. American Express prints four digits on the front. The code confirms that the buyer holds the physical card. Stolen card records sold online bundle the card number, expiry date, cardholder name, billing address, and CVV.
How stolen card data reaches a carding site
- Breach of a merchant database that stored card numbers without encryption.
- Skimmer hardware on a fuel pump, ATM, or self-checkout lane.
- Phishing page that copies a bank login or a checkout form.
- Fake gift shop that captures card fields at checkout and never ships an order.
Why gift and greeting card shops see this fraud
Small-ticket gift orders work as test charges. A fraudster runs a $1 to $5 charge on a stolen number. If the charge clears, the same number gets used for larger purchases. Card testing shows up as a burst of small declines at one merchant inside a short window.
Red flags at checkout
- A $60 bouquet listed at $9, with no stated reason.
- Payment by gift card code, crypto, or wire transfer.
- Domain registered less than 90 days ago.
- No street address, no phone number, no return policy.
- Card fields on a page with no HTTPS padlock.
- A request to send a photo of the card by email or chat.
Law and penalties
In the United States, 18 U.S.C. § 1029 covers trafficking in access devices and carries up to 10 years for a first offense. The UK Fraud Act 2006 and the Computer Misuse Act 1990 cover the same conduct. Merchants absorb the chargeback. Cardholders recover the money after a dispute but spend hours on calls and forms.
Steps after a card number is exposed
- Call the number on the back of the card and ask for a freeze.
- Request a new card number, not just a new card.
- Read statements for 12 months and dispute unknown charges in writing.
- File a report with the Federal Trade Commission and with local police.
Safer ways to buy gifts online
Pay with a credit card. US law caps cardholder liability at $50 for credit cards. Debit cards can leave a bank account short while a dispute runs. Some issuers offer virtual card numbers tied to one merchant. Check the shop address, the return window, and the shipping date before paying. Keep order confirmations for 12 months.