Short answer
A CVV is the 3-digit code printed on the back of most Visa, Mastercard, and Discover cards, or the 4-digit code on the front of an American Express card. It is a security feature of a payment card. It is not a product class, and there is no lawful marketplace that sells CVV numbers. Sites and forums that advertise CVVs for sale handle stolen card data. That activity is identity theft and access device fraud under U.S. law. This page explains the code and the law. It lists no such market.
What the CVV does
Card networks use the code as a second check when the physical card is not present. A merchant submits the card number, the expiration date, and the CVV. The issuer compares the code against its records. A mismatch declines the charge. The code is not stored on the magnetic stripe or the EMV chip, so a skimmed card alone does not produce it.
Two names, one check
- CVV2, CVC2, or CID: the printed code used in online and phone orders.
- CVV or CVC: the encoded value used when the card is swiped or dipped.
What the term means in fraud listings
Listings that use the phrase "CVV" as inventory are selling card numbers with the printed code attached. Sellers add a bank identification number, a cardholder name, a billing address, or a Social Security number. Buyers use the data to place orders for goods that are resold. The cardholder usually learns about the charge at the next statement. Prices in these listings track the card's credit limit, the issuing bank, and the freshness of the data. None of that makes the sale legal.
where sell cvv online instant payment
Legal exposure under U.S. law
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Selling, transferring, or possessing card numbers with intent to defraud carries prison terms and fines. 18 U.S.C. § 1028 covers identity theft. The FTC treats the sale of stolen card data as a deceptive practice and brings civil actions. A buyer who uses the data to obtain goods commits the same offense as the seller.
If your card data is exposed
- Call the number on the back of the card and ask for a freeze or a new number.
- Review statements for charges you do not recognize, including charges under $5.
- Set a fraud alert or credit freeze with the three credit bureaus.
- File a report at IdentityTheft.gov and keep the confirmation number.
- Report the listing to the FBI Internet Crime Complaint Center if you have the address.
Related facts
Card networks do not publish a list of carding sites. Search results for these terms often lead to cloned storefronts that take payment and deliver nothing. The FTC reports that these sites collect card data and resell it. A site that asks for a CVV to "verify" a buyer before selling stolen data is running a second theft on the buyer.