A CVV listing is a record of stolen payment card data offered for sale on criminal forums and dark web markets. It pairs a card number and expiration date with the card's CVV security code, which is the value a fraudster needs to approve a card-not-present charge. Buying, selling, or using that data is a federal crime in the United States, and no legal marketplace for it exists anywhere.
What does a CVV listing contain?
Sellers package the exact fields an online checkout form asks for, so a purchase clears without a phone call or a manual review.
CVV Enumeration Index: A Guide to Buying CVV
- Card number and expiration date
- CVV or CVC code printed on the card
- Cardholder name, billing address, and ZIP code
- Bank name, card brand, and issuing country
- Some bundles add a Social Security number, email, and phone number, a package known as "fullz"
Other listings note the credit limit, whether the card is debit or credit, and the result of a test charge. Sellers label stock as fresh or used, though those tags say nothing about whether the card still works.
Is buying or selling a CVV listing illegal?
Yes. In the US, trafficking in card data falls under 18 U.S.C. § 1029, the access device fraud statute. A first offense carries up to 10 years in prison, repeat offenses up to 15 years, and fines on top.
State prosecutors add identity theft and larceny charges, and victims can sue for damages. Courts treat stolen card data as a tool of crime even when no purchase has been made yet.
Where does the data in these listings come from?
Card details reach criminal markets through a few routes that seldom involve hacking a bank.
- Skimmers placed on ATMs, fuel pumps, and self-checkout readers
- Phishing pages and fake storefronts that copy what shoppers type
- Malicious scripts injected into real payment pages
- Breaches at merchants, hotels, and payment processors
- Malware on a phone or laptop that grabs saved card details
Stolen data gets tested with small charges before it goes up for sale. An authorization for a dollar or two that you never made is a common first sign.
How do you know if your card appears in a CVV listing?
You cannot look up a public registry of stolen cards, and services that promise a check are scams that collect your card data themselves. Watch your account activity instead.
- Tiny test charges, often under $5, that you do not recognize
- Charges from merchants or states you never visited
- New accounts, credit inquiries, or address changes you did not make
- A bank notice about a data breach that covers your card
- Mail that stops arriving, which can point to an address change by a thief
Card issuers run their own monitoring and reissue cards after a confirmed breach, sometimes before you notice anything.
What should you do if your card data is exposed?
Move fast, because the first fraudulent charge is rarely the last.
- Freeze the card in your banking app or call the number on the back.
- Report the fraud to the issuer and dispute every charge you did not make.
- Change passwords on shopping, email, and banking accounts, then turn on two-factor authentication.
- File a report at IdentityTheft.gov and keep the confirmation.
- File a complaint with the FBI's Internet Crime Complaint Center if money was lost.
- Place a free credit freeze with Equifax, Experian, and TransUnion if your SSN was exposed.
Federal law caps your liability for unauthorized card charges at $50, and most issuers waive even that when you report in a reasonable time.
How do banks and merchants block CVV fraud?
Payment rules remove the easiest path for thieves. PCI DSS bans storing the CVV after a transaction is authorized, so a database breach does not hand over the code.
- Tokenization swaps the card number for a placeholder value
- 3-D Secure adds a bank check during checkout
- Address verification compares the billing ZIP to the issuer's record
- Velocity checks flag many small purchases from one device or IP
- Machine learning scores each order against known fraud patterns
These controls push card-not-present fraud rates down, but no single check stops every stolen card.
FAQ
Is there a legal way to buy a CVV?
No. Every sale of another person's card data is a crime under US law and similar statutes in other countries. Sites that advertise CVV sales are either fraud operations or law enforcement stings.
Is a CVV the same as a PIN?
No. The CVV is a three or four digit code printed on the card for online use. A PIN is a secret number you enter at a terminal or ATM, and it never appears on the card.
Why do thieves want the CVV?
Online merchants ask for the CVV to prove the buyer holds the physical card. A stolen card number alone fails that check, so the code raises the value of a stolen record.
Does a CVV listing mean my card is already compromised?
Not always. Data can be bundled, resold, or outdated. Treat any breach notice as a reason to replace the card rather than wait for a charge to appear.
Can I check if my card is for sale?
No legitimate service offers that lookup. Anyone who asks for your full card number to run a check is trying to steal it.