What does "CVV dump" mean?
A CVV dump is a batch of stolen payment card records, packaged for illegal sale or trade, that typically includes the card number, expiry date, cardholder name, and the card verification value (CVV). The phrase comes from criminal marketplaces, not from banks, card networks, or retailers, and no legitimate business ever sells or buys one. Buying, selling, or using a CVV dump is payment card fraud in every U.S. state and in most countries worldwide.
Understanding the term matters because it shows up in scam messages that target ordinary shoppers, including people buying greeting cards and gift cards online.
Why CVV dumps show up in gift and greeting card scams
Gift cards are a favorite tool for criminals holding stolen card data. A stolen card number can be used to buy gift cards quickly, and those cards are then resold or drained before the real cardholder notices. That is why a suspiciously cheap gift card sold through a social media message or a random marketplace listing is often a red flag rather than a bargain.
Greeting card shoppers get pulled in through fake storefronts, phishing emails about "order problems," and messages offering steep discounts on gift card codes. The scammer wants your card details or a gift card code, not your business.
Warning signs to watch for
- A seller asks you to pay with gift card codes instead of a normal checkout.
- Someone offers a gift card or greeting card bundle at a price far below retail.
- A message pressures you to act within minutes or threatens account closure.
- A "verification" page asks for your full card number, CVV, and PIN together.
- A marketplace listing shows stock photos, no return policy, and no verifiable business identity.
Is using a CVV dump illegal?
Yes. Using card data that belongs to someone else is fraud, and possession of dumps with intent to use them is a crime in the United States under federal law and parallel state statutes. Penalties can include prison time, fines, restitution, and a permanent criminal record. Victims are not the only ones harmed: merchants absorb chargebacks, and those costs get passed on to everyday shoppers through higher prices.
How to protect your card and your gift purchases
Shop only with established retailers and use a credit card, which offers stronger dispute rights than a debit card or gift card code. Turn on transaction alerts through your bank app so an unexpected charge reaches you within seconds. Never read a card number, CVV, or one-time code aloud to someone who contacted you first.
When you buy greeting cards or gifts online, check that the checkout page is encrypted, review the return policy, and keep the confirmation email. If a deal looks impossible, search the seller name plus the word "scam" before paying.
If your card data is exposed
- Call the number on the back of your card and ask the issuer to freeze or replace it.
- Review recent statements line by line and dispute anything you did not authorize.
- Change passwords on shopping accounts, especially if you reused them.
- Report the incident to the Federal Trade Commission and, if money was lost, to your local police.
Legitimate alternatives to buying a dump
If you need a gift, buy gift cards directly from the retailer, from a major grocery or pharmacy chain, or from the brand's own website. Prepaid cards from known issuers work for people without a bank account and come with normal consumer protections. There is no lawful shortcut, reseller trick, or "tested" batch that makes stolen card data safe to touch.
Frequently asked questions
Can a gift card be a CVV dump?
No. A gift card is a prepaid store balance, while a CVV dump is stolen bank card data. They are different products with different legal status.
Do CVV dumps ever contain real, working numbers?
Some do, which is exactly why using one is a crime and why banks monitor for the pattern. Many listings are also fabricated to cheat other criminals, so buyers lose money either way.
What should I do if someone offers to sell me card data?
Decline, save the messages as evidence, and report the account to the platform and to the FBI's Internet Crime Complaint Center.