There is no legitimate place to sell a CVV. A CVV, or card verification value, is the three or four digit security code printed on a payment card, and it exists for one purpose: to show that the person entering it is holding the physical card. Buying, selling, or trading CVV data is card fraud in the United States, the United Kingdom, the European Union, Canada, Australia and most other jurisdictions. The sites and chat channels that advertise CVV listings are almost always scams aimed at the buyer, or they are run with law enforcement visibility. If you arrived here looking for a market, the accurate answer is that none exists that you should touch. If you are shopping for greeting cards and gifts and want to keep your own code safe at checkout, the rest of this guide is for you.
What a CVV actually is
The code goes by several names: CVV, CVV2, CVC2, CID, or card security code. Visa, Mastercard and Discover print three digits on the back near the signature strip. American Express prints four digits on the front, above the card number. The code is generated from the card number, the expiry date and a secret key held by the issuer. It is not stored in the magnetic stripe or the chip, which is why a card skimmer at a fuel pump can clone a card number but still cannot complete an online order without the code.
What to check before you type your CVV into a gift shop checkout
- The address bar shows a padlock and the site uses HTTPS across the whole checkout, not just the home page.
- The checkout collects the code in a hosted payment field or redirects to a recognised payment processor, so the shop never sees the digits.
- A privacy policy and a returns policy are present and readable, with a real business address or registration number.
- The site asks for the minimum: card number, expiry, code and billing postcode. Anything else, such as a photo of the card or a full bank login, is a red flag.
Risks to avoid
Phishing pages copy a gift shop's design and harvest card details including the code. Messaging app listings that offer card data at a discount are fraud, and paying for them can expose you to extortion or prosecution. Gift card resale scams are a separate problem: a card bought below face value is often already drained. Keep the code covered in public, never read it aloud on a call you did not initiate, and treat any request for it by email or text as hostile.
FAQ
Is selling a CVV ever legal?
No. The code belongs to the cardholder and the issuing bank. Transferring it for money is unauthorised use of payment credentials.
Can I store my own CVV in a password manager?
Some managers offer it, but payment industry rules forbid merchants from storing it after a transaction. Keeping it only on the card is safest.
What if my code was exposed?
Contact your issuer, freeze the card and dispute unfamiliar charges. Liability for unauthorised use is limited when you report promptly.
Why do some shops ask again for the code on a saved card?
Because they are not allowed to keep it. Re-entering it confirms you still hold the physical card.