Answer
Selling a CVV is a crime. A CVV is the three or four digit security code on a payment card. It is not a product, a gift, or a collectible. In the United States, 18 U.S.C. Section 1029 covers the sale and transfer of payment card numbers and codes. Sentences include prison time and fines. The same conduct is prosecuted in the UK under the Fraud Act 2006, in Canada under the Criminal Code, and across the EU under national fraud laws.
What the term means
A CVV is a card verification value. Visa uses the name CVV2. Mastercard uses CVC2. American Express prints a four digit code on the front of the card. The code ties a card number to the physical card in the cardholder's hand.
- Visa, Mastercard, Discover: 3 digits, printed on the back.
- American Express: 4 digits, printed on the front.
- Missing or unreadable code: the merchant cannot complete a card not present transaction.
Storage and handling rules
PCI DSS, the payment card industry data security standard, lists the CVV as sensitive authentication data. A merchant may not store it after a transaction is authorized. A shop that keeps CVVs in a database or a spreadsheet is out of compliance.
If you run a card or gift shop
You need a payment processor, not a CVV list. Processors handle authorization, settlement, and chargebacks. A greeting card or gift seller with a card terminal or a hosted checkout never sees or keeps the code.
- Use a processor that meets PCI DSS.
- Never write the code on a paper order form.
- Never email a code to a customer or a supplier.
- Train staff who take phone orders.
If someone offers to sell you CVVs
That offer is a fraud offer. The data is stolen or fake. Buying it exposes you to criminal charges and to civil claims from card issuers. Report the contact to the FBI Internet Crime Complaint Center in the US or Action Fraud in the UK. Contact your card issuer if your own card data is involved.