A CVV shop is an illegal storefront that trades stolen credit card numbers and their CVV security codes. Buying from one, or running one, breaks federal law in the United States and similar laws in most other countries, with penalties that include prison time and heavy fines. There is no legal version of this business.
This guide covers what these marketplaces sell, why the law treats them as criminal operations, and how gift shops and greeting card sellers can protect their own stores from the card fraud they spread.
What Does a CVV Shop Sell?
Card data. A CVV is the three-digit code on the back of most Visa, Mastercard, and Discover cards, and the four-digit code on the front of American Express cards. That code proves the person typing it holds the physical card, which is why thieves pair it with the card number, expiry date, name, and billing address.
Sellers bundle the data into batches. Some list "fullz," which adds a cardholder's Social Security number or bank login. Prices move with the card's credit limit, the issuing bank, and the country, and many shops run on subscription access with cryptocurrency payments.
Why Is Selling Card Data a Crime?
In the United States, card data falls under access device fraud at 18 U.S.C. § 1029, alongside wire fraud and identity theft statutes. The law covers anyone who traffics in card numbers, CVV codes, or the software that harvests them. Courts treat large-scale card trading as organized crime, not a gray-area hustle.
Other countries take the same view. The UK, Canada, Australia, and EU member states all criminalize trafficking in payment credentials.
What Penalties Do Card Data Sellers Face?
Sentences under 18 U.S.C. § 1029 can reach 15 years for some offenses, with fines that can reach $250,000 for an individual. A single count can cover thousands of cards, so prosecutors stack charges. Restitution orders follow, and banks and cardholders can file their own suits.
Payment processors also blacklist merchants tied to fraud rings, which ends any chance of taking card payments through a normal gateway.
How Do Fraud Rings Get Card Data in the First Place?
Skimmers on gas pumps and ATMs, phishing pages that copy a bank login, malware on a retailer's checkout, and data breaches at hotels and stores. Stolen records then flow to carding forums and the shops that resell them.
Gift shops rarely get targeted for their database, but their checkout pages do get tested with small orders. A $1 test charge followed by a large order is a common pattern.
How Does Card Fraud Reach Gift Shops and Greeting Card Stores?
Most gift shops sell online, which means they accept card-not-present payments. That is the exact channel a stolen card works best in, because no one checks a signature or a chip.
A fraudster orders a personalized gift, a boxed card set, or a luxury hamper, ships it to a drop address, and disappears. Weeks later the real cardholder disputes the charge. The shop loses the goods, the shipping cost, and the transaction amount when the chargeback lands, plus a dispute fee from the processor.
Repeat hits raise a merchant's chargeback ratio. Cross roughly 1% of transactions and processors place a shop in a monitoring program. Higher ratios lead to frozen funds or a closed account.
How Can a Gift Shop Block Fraudulent Orders?
- Turn on AVS and CVV checks in the payment gateway. Mismatched numbers are a warning sign.
- Use 3-D Secure for orders above a set value. The bank then carries the fraud liability.
- Watch for velocity. Several orders from one IP address or card in a short window is a pattern real gift buyers do not create.
- Flag mismatches. A billing address in one country and a shipping address in another deserves a manual check.
- Set a review threshold. Orders that jump past your average order value get a second look before they ship.
- Track free email domains on high-value orders. Fraud rings lean on disposable addresses.
What Should a Shop Do With a Suspicious Order?
- Do not ship. Hold the order until it clears.
- Call the customer at the number from the order and ask for details only the cardholder would know.
- Email a request for a bank authorization code or a photo of the card with the middle digits covered.
- Refund through the gateway if the check fails, and tag the order as fraud in your admin.
- Report the attempt to your payment processor and to the FBI's Internet Crime Complaint Center.
Keeping a written log helps if the processor reviews your account later.
How Do You Sell Greeting Cards and Gifts the Legal Way?
Run your own store with your own inventory. Design and print your cards, source gifts from licensed wholesalers, and take payments through an established processor.
If you want recurring income without holding stock, sell designs on print-on-demand and marketplace platforms that handle payment and fraud screening for you. You keep the margin and let someone else carry the risk of card checks.
Selling customer card data, even once, ends that business. It also ends any future with a payment provider.
FAQ
Is selling CVV numbers a crime?
Yes. Trafficking card numbers and CVV codes is a felony in the US under 18 U.S.C. § 1029 and a criminal offense in the UK, Canada, Australia, and the EU.
Can a legal gift shop sell card data it already holds?
No. Card network rules and PCI DSS forbid storing or selling card data beyond what a transaction needs. Merchants who do face fines, lost processing rights, and criminal charges.
What should I do if someone offers to sell me card data?
Decline, keep the message, and report it to your processor and to the FBI's IC3. Buying the data puts you in the same case as the seller.
Does my small shop need fraud tools?
Yes, if you take card payments online. AVS, CVV checks, and 3-D Secure cost little and block most stolen-card orders.
Key Takeaways
- A CVV shop is an illegal market for stolen card data, and no legal version exists.
- Selling or buying card data carries prison time, fines, and civil suits.
- Gift shops absorb the cost through chargebacks, lost stock, and processor penalties.
- AVS, CVV checks, 3-D Secure, and manual review stop most fraudulent orders.
- Legitimate income in this niche comes from cards, gifts, and print-on-demand designs.