Short answer
You cannot test a card from a CVV shop without breaking the law, and there is no reliable way to do it. CVV shops sell stolen payment card data, and checking whether a stolen card works is access device fraud under 18 U.S.C. § 1029 in the United States. One authorization attempt is enough to trigger charges.
CVV Shop Vendor Reputation Check Before Purchase Guide
What is a CVV shop?
A CVV shop is a marketplace that sells card numbers, expiration dates, and security codes taken from other people's accounts. Sellers collect that data from breaches, skimming devices, and phishing pages, then resell it through forums, chat channels, or hidden sites.
what checks should i do before buying from cvv shop
Listings often promise a "validity rate" or a replacement if a card fails. Those claims are sales talk. Nobody can promise a stolen card will work, because the real cardholder or the issuing bank can freeze it at any moment.
- What gets sold: full card number, expiry, CVV/CVC, and often the cardholder name and billing address.
- How payment works: crypto only, with no refund path and no buyer protection.
- What the buyer risks: criminal charges plus the chance the seller takes the money and disappears.
What US law says about testing a stolen card
Federal law treats card data as a regulated "access device," and using one you do not own is a crime on its own. The statutes stack, so a single test can support several counts.
- 18 U.S.C. § 1029: fraud with an access device carries up to 10 years in prison for a first offense, up to 15 years for repeat offenses, plus fines.
- 18 U.S.C. § 1028A: aggravated identity theft adds a mandatory 2-year term that runs after any other sentence.
- 18 U.S.C. § 1343: wire fraud can apply when the internet is used, with penalties up to 20 years.
Prosecutors do not need a completed purchase. Attempting to authorize a card that belongs to someone else is the offense.
Why online "card checker" services are a trap
Tools that claim to verify cards from a CVV shop exist to profit from the people using them. Most are phishing operations that harvest card data and crypto payments, then vanish.
- Some log every number submitted and resell it to another buyer.
- Banks and card networks flag failed authorization attempts, and merchants keep records.
- There is no neutral version of this service. A legitimate processor will not check a card you do not own.
What legitimate card validation looks like
Real card verification happens on the merchant side, with the cardholder's consent, and follows the PCI DSS standard. Each check answers a specific question and none of them reveal a stolen card's status to a third party.
- CVV/CVC check: the merchant asks the issuer to confirm the security code at checkout. Codes cannot be stored after authorization.
- Address Verification Service (AVS): the billing address is matched against the issuer's records.
- 3-D Secure: the cardholder approves the payment in their bank's app or with a one-time code.
- For your own card: open your issuer's app or call the number on the back to see recent charges and card status.
If your card data shows up for sale
Card data from breaches often appears in shops before the cardholder notices anything. Speed matters more than anything else here.
- Freeze the card in your bank's app or call the issuer.
- Dispute charges you do not recognize and request a new card number.
- Report the theft at IdentityTheft.gov and file a complaint with the FBI's IC3.
- Check your credit reports for new accounts opened in your name.
FAQ
Can a Luhn check tell me if a card is valid?
No. The Luhn formula only tests whether a string of digits matches the checksum pattern for a card number. It says nothing about whether the account is open, funded, or stolen, and running it on someone else's card data is still access device fraud.
Is buying CVV data a victimless crime?
No. The money comes out of real accounts, and cardholders spend hours disputing charges and replacing cards. Banks pass fraud losses back to customers through fees and higher rates.
What happens if I test just one card?
Charges can follow a single attempt. Issuers, merchants, and payment processors keep logs of authorization requests, and those records support prosecution.
Do CVV shops ever sell real cards?
Some do, which is exactly why the data is illegal to use. Others sell invented numbers or data that has already been cancelled, and the buyer has no way to tell the difference before paying.