Short answer
A CVV shop is a criminal storefront that sells stolen payment card data. In the United States, buying card data from one is a federal crime. This page does not list markets, onion addresses, or access steps. It covers what the term means, who investigates it, and what buyers face in court.
darknet marketplaces for cvv fresh
What a CVV record contains
CVV stands for card verification value. It is the 3-digit code on the back of most cards and the 4-digit code on the front of American Express cards. The code exists to prove that the person paying holds the physical card.
Sellers bundle the code with other fields. A common bundle is called fullz: card number, expiry date, CVV, cardholder name, billing address, phone number, and in some cases a Social Security number and date of birth. Data at that level comes from point-of-sale skimmers, phishing pages, database breaches, and theft by employees with access to payment systems.
Why the shops fail
Card networks and issuers watch for card-not-present fraud. A card reported stolen gets blocked, and the authorization fails. Sellers also run exit scams against buyers. A buyer who pays and gets nothing has no recourse, because the transaction itself is illegal and the counterparty is anonymous.
Hidden CVV Shops on Tor: A Comprehensive Guide
Federal prosecutors charge these cases under 18 U.S.C. § 1029, which covers trafficking in unauthorized access devices, including card numbers and CVVs. Penalties include prison terms and fines.
- FBI: investigates cyber-enabled financial fraud, including carding operations.
- US Secret Service: investigates payment card fraud and intrusions at payment processors.
- FTC: tracks identity theft reports and runs IdentityTheft.gov for consumers.
For cardholders
Report a lost or misused card to the issuer. Place a fraud alert or credit freeze with the three credit bureaus. File a report at IdentityTheft.gov and keep the confirmation number. Under the Fair Credit Billing Act, a consumer's liability for unauthorized credit card charges is capped at $50, and many issuers waive that amount.
Limits of this page
Numbers for market size and takedown counts change and are not stated here. Sources disagree on how much stolen card data circulates. The legal position does not change: buying, selling, or using card data without authorization is a crime in the US.