A CVV shop is an illegal marketplace that sells stolen card numbers and CVV codes, so no legitimate buying guide exists. Buying, selling, or using another person's card data is card fraud under US federal law, and buyers face frozen funds, criminal charges, and no legal recourse when a shop takes their money and disappears.
What is a CVV shop?
A CVV shop is a website that claims to sell card numbers paired with CVV codes, usually for cryptocurrency. The inventory comes from breaches, skimming devices, and phishing, not from banks or cardholders. These sites operate outside card network rules, which means a buyer has no contract, no refund path, and no way to verify what is being sold.
Is buying CVV data illegal in the United States?
Yes. Trafficking in card numbers falls under access device fraud, 18 U.S.C. Section 1029, which covers producing, selling, and possessing unauthorized access devices. Prosecutors pair that charge with wire fraud and identity theft counts when card data is used to move money. A buyer does not need to succeed at a purchase to commit the offense; intent and possession are enough.
What actually happens to people who buy card data?
- Card issuers flag the transaction and reverse it, so the delivered data is often dead on arrival.
- Shop operators routinely keep the payment and deliver nothing, and victims cannot report the loss without admitting a crime.
- Law enforcement monitors carding forums, and sealed complaints are built from chat logs and wallet records.
- Buyers in the US face restitution, felony records, and immigration or employment consequences.
What does a CVV code actually do?
The CVV is a three or four digit value printed on a card that proves the physical card is present during a card-not-present transaction. Its only purpose is fraud reduction, which is why card networks forbid merchants from storing it after authorization. A CVV code has no resale value to a legitimate business.
How is CVV data protected?
PCI DSS requires merchants to encrypt cardholder data in transit and at rest and to never retain the CVV after authorization. Cardholders can add tokenization through mobile wallets, turn on transaction alerts, and freeze a card in seconds through an issuer app. These controls are what make stolen CVV data expire quickly and lose value.
What should you do if you find card data for sale?
Report it to the FBI Internet Crime Complaint Center and to the card issuer named on the data. If you were sold card data and lost money, talk to an attorney before sending anyone more funds. Cardholders who spot unauthorized charges should report them to the issuer right away, since US rules cap consumer liability when the loss is reported promptly.
Is there any legal place to buy CVV data?
No. Card data belongs to the cardholder and the issuing bank, and no license, reseller program, or bulk contract makes a sale lawful. Businesses that need card details collect them directly from customers under a merchant agreement and PCI DSS obligations.