A CVV2 shop is not a real store. The term describes illegal online marketplaces that sell stolen card numbers and the three or four digit security codes printed on payment cards. Legitimate retailers, including greeting card and gift shops, never sell card data. They only ask for your CVV2 at checkout to confirm you are holding the physical card.
What does CVV2 mean on a payment card?
CVV2 stands for Card Verification Value 2, a code issued by Visa, Mastercard and Discover that appears as three digits on the back of the card. American Express uses a four digit version on the front, often called the CID. The code is not stored on the magnetic stripe or the chip, so it proves the buyer has the card in hand.
Payment rules treat the CVV2 as sensitive authentication data. Merchants may use it to approve a purchase, but they are not allowed to keep it after the transaction completes.
Why are CVV2 shops illegal?
Sites that advertise card numbers, security codes or full personal profiles for sale are fencing stolen financial data. This activity is commonly called carding, and it is a federal crime in most countries. Buyers and sellers both risk prosecution, account seizure and permanent bans from payment networks.
Card data sold this way is often already reported stolen and flagged, so buyers usually receive nothing of value.
How to recognize a fraudulent card data seller
- Offers to sell card numbers, CVV2 codes or bundles of personal data.
- Accepts only cryptocurrency and provides no business address or registration.
- Uses chat apps or private forums instead of a normal retail storefront.
- Promises guaranteed working cards or refunds on stolen data.
How to shop safely for greeting cards and gifts online
- Confirm the checkout page uses HTTPS and shows a valid padlock.
- Type your CVV2 only into the payment form of a store you chose, never into an email, chat or text message.
- Use a virtual card number or a payment service that masks your real card details.
- Review your statement each month and dispute any charge you do not recognize.
- Keep receipts for gift orders so you can match them to posted charges.
What should you do if your card details are exposed?
Call the number on the back of your card and ask the issuer to freeze the account and reissue the card. Then change passwords on shopping accounts that stored the card, since stolen CVV2 data is often paired with login credentials. Report the incident to your national fraud reporting center so the seller's infrastructure can be investigated.
Frequently asked questions
Do I have to give my CVV2 when buying a gift card online?
Yes, a merchant may require it for a card not present purchase. You should still only enter it on the merchant's own secure checkout page.
Can a CVV2 shop sell me a valid card?
No. Any site selling card numbers or codes is trading stolen property, and the data is usually cancelled or monitored before it reaches a buyer.
Is the CVV2 the same as my PIN?
No. The CVV2 verifies card not present purchases online, while a PIN authorizes in person and cash transactions at a terminal.