What a CVV is
CVV stands for card verification value. Visa, Mastercard and Discover print three digits on the back of the card. American Express prints four digits on the front. The issuer generates the number and ties it to one card account.
The CVV proves the person typing the card number holds the physical card. Card networks require it for most card-not-present orders. A gift shop, a florist or a card retailer asks for it when you pay online.
Why no one sells CVV numbers
The CVV is not a product. It has no retail price, no distributor and no authorized reseller. A search for "where to buy CVV" returns two kinds of results: pages that offer stolen card data, and pages that explain the term.
Card numbers with CVV codes come from data breaches, skimming devices and phishing. Selling them is a federal crime in the United States under 18 U.S.C. 1029. Penalties reach 10 years in prison for a first offense and 15 years for repeat offenses. In the United Kingdom, the Fraud Act 2006 covers the same conduct.
Buyers face the same charges as sellers in most jurisdictions. The cardholder disputes the charge, so the data has no lasting value.
What to do instead
If you want to buy a greeting card, a gift or a gift card, use your own payment card.
- Buy from the card issuer or a store you know. Grocery chains, pharmacies and the issuer's own site are the standard channels.
- Check the balance at the register before you leave. Ask the cashier to scan the card.
- Keep the receipt. It carries the card number and the activation record.
- Read the terms. Some gift cards charge a monthly fee after 12 months. Some expire.
- Spend the card within a few months. Stored balances are a target for draining scams.
Pitfalls
- Third-party gift card marketplaces. Resold cards can be empty or deactivated.
- Sellers who ask you to pay with a gift card. Legitimate shops do not do this.
- Websites that list CVV codes for sale. They take payment and deliver nothing, or they deliver stolen data and pass your details to law enforcement.
- Anyone who asks for your CVV by phone, email or chat. No bank or shop needs it in those channels.
Storing your own CVV
PCI DSS rules bar merchants from storing the CVV after authorization. Write it down only if you keep the paper in a locked place. Do not photograph it or save it in a notes app.