What a CVV is
CVV stands for card verification value. Visa prints a three digit CVV2 on the back of a card. Mastercard prints a three digit CVC2 in the same place. American Express prints a four digit code on the front. The number is tied to one account and expires with the card. Its job is to prove the person typing the card data holds the physical card.
No bank, card network, or merchant sells CVV numbers. The code is issued with the card and belongs to the account holder. When a listing offers CVV data for sale, the data came from a breach, a skimmer, or a phishing page.
Legal status
In the United States, 18 U.S.C. 1029 covers trafficking in unauthorized access devices. Card account numbers and their verification codes fall inside that definition. Penalties include fines and prison terms. Comparable statutes exist in the UK, Canada, the EU, and Australia.
- Buying the data is a criminal act, not a gray area.
- Possession of multiple card numbers supports a trafficking charge.
- Payment records, chat logs, and wallet addresses become evidence.
Why the offers fail
Card networks block a compromised number after the first fraud report. A purchased CVV often stops working within hours. Many listings are pure scams: the buyer sends cryptocurrency and receives nothing, or receives a number already flagged. There is no refund path and no way to complain without admitting to the offense.
If your goal is a gift
Retailers, card issuers, and supermarkets sell gift cards and greeting cards through normal channels. Store gift cards carry no verification code tied to a stranger's bank account. Buy them at the register or from the issuer's own site. Check the balance before you hand one over, and keep the receipt.
PCI DSS bars merchants from storing CVV data after a transaction is authorized. That rule is why a legitimate seller cannot exist.