What the term means
CVV stands for card verification value. It is the extra code printed on a payment card. Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID and prints 4 digits on the front. Visa and Mastercard print 3 digits on the back, beside the signature strip. The code is not written to the magnetic stripe. It is not stored on the EMV chip. Issuers added it so a merchant could check that the buyer holds the physical card during a phone or online order.
There is no legal market for CVVs
Card networks do not sell verification codes. Banks do not resell them. In the United States, 18 U.S.C. 1029 covers trafficking in access devices, a category that includes card account numbers and the codes attached to them. The UK Fraud Act 2006 covers possession of articles for use in fraud. Other jurisdictions have comparable statutes. A listing that offers to sell a CVV is an offer to commit a crime in the seller's country and in most buyers' countries.
What the search results are
Pages that rank for this phrase fall into 3 groups.
- Scam storefronts. The seller takes payment in gift card codes or cryptocurrency, delivers nothing, and closes the account.
- Card testing fronts. The site collects the buyer's own payment details and resells them.
- Law enforcement and news pages that describe the scams.
Complaint data from the FBI Internet Crime Complaint Center and the FTC shows payment fraud is a large category, and recovery of funds sent by gift card or crypto is rare.
What to do instead
If you need a payment method for online purchases, use a card issued in your own name. Several issuers provide virtual card numbers that rotate per merchant. That limits damage if one merchant is breached. Check your statements each month and dispute charges you do not recognize.
What gift and greeting card sellers should check
Card-not-present orders carry higher fraud risk than in-store orders. Basic controls: require the CVV result at authorization, run address verification, ship only to the billing address on first orders, and never store the verification code after authorization. PCI DSS requirement 3 forbids storing it. A failed CVV check does not always mean fraud, since the code can be misread, but repeated failures on one account are a signal.
If a card code reaches you by mistake
Do not use it. Report it to the issuer named on the card, or file a complaint with the FTC. Using a code that is not yours is the act the statutes above cover.
Bottom line
There is no product to compare and no seller to vet. The purchase is illegal, the goods do not exist, and the payment method requested is the one with no chargeback route.