You sell greeting cards online by listing designs on a marketplace or your own store, then letting a payment provider handle the card data. You never store the card security code, called the CVV, on your side. That one rule keeps a small card business inside the easier set of payment rules.
What does a CVV do on a card payment?
The CVV is the three-digit code on the back of most cards, or four digits printed on the front of American Express. It confirms the buyer holds the physical card, which is why it cuts copied-card fraud on online orders.
Card network rules ban merchants from keeping the CVV after a transaction is authorized. If your order form drops it into a spreadsheet, you break those rules and put your merchant account at risk.
Why you should never ask a customer to send a CVV by email, chat, or DM
An emailed code sits in plain text in two inboxes forever. A buyer who sends it has handed a stranger the ability to charge that card. Take payment on a hosted checkout page instead, and never ask for codes over email, chat, or a phone note.
Is it legal to buy or sell card numbers and CVVs?
No. Buying, selling, trading, or advertising card numbers and CVVs is card fraud. In the United States it falls under 18 U.S.C. § 1029, which carries prison terms and fines.
Websites that claim to sell CVVs are either scams that take your money or fronts for stolen data. There is no legal market, no escrow service, and no verified vendor for this.
Which payment setup fits a greeting card shop?
- Marketplace: Etsy, Amazon Handmade, Zazzle. They run checkout and hold the card data. You pay listing and transaction fees and get buyers without ad spend.
- Hosted checkout: Stripe, Square, PayPal. You keep your own store and the provider's page collects the card details.
- Card reader at craft fairs: a Square or SumUp reader plus a phone covers in-person sales.
- Never: typing card numbers into a notes app, a spreadsheet, or a chat thread.
How do you price and ship greeting cards?
Blank cards with an envelope sell for $4 to $8 each. Boxed sets run $15 to $30 depending on printing and artwork, and handmade or letterpress cards sit at the top of that range.
Shipping one card inside the US costs a first-class stamp when it fits a standard envelope and weighs under one ounce. Rigid mailers and boxed sets cost more and need tracking.
Weight and thickness decide the rate, so check a kitchen scale before you publish shipping prices. Undercharging on postage eats the profit on a $5 card.
What sells best in a greeting card shop?
Everyday occasions beat holidays for small shops: birthdays, thank-you notes, new baby, sympathy, and blank cards. Holiday orders spike for six weeks and then stop.
Gift add-ons raise the order value. Pairs that work include a card plus a candle, a card plus a bookmark, or a boxed set with a pen.
What should you do before your first sale?
- Pick three to five designs and photograph them on a plain background.
- Set prices that cover printing, envelopes, packaging, and fees.
- Open a business bank account so payouts stay apart from personal money.
- Set up a hosted checkout and run one live test order yourself.
- Write a short returns policy for damaged or misprinted cards.
Do you need PCI DSS compliance to sell cards online?
You need to comply, but the scope depends on how you take payment. A hosted checkout or a card reader keeps card data on the provider's systems, which leaves you with a short self-assessment questionnaire.
Can you take card payments over Instagram or Facebook messages?
No. Use the platform's shop tools or send a payment link from your provider. Asking for card photos or codes in a DM breaks both platform rules and card network rules.
What if a customer asks you to keep their CVV for next time?
Say no and explain that card rules forbid it. Offer to save their shipping address instead, or let the payment provider store the card for repeat orders.
How do you spot a fake "sell CVV" offer?
Red flags include prices far below market, crypto-only payment, screenshots offered as proof, no company name, and pressure to act fast. Real payment processors publish a registered name, a physical address, and a support phone number.
If you paid such a site, call your bank and report it to your national fraud line. Do not send more money to recover a loss.