What a CVV is

A CVV is the short code printed on a payment card. Visa, Mastercard, and Discover print three digits on the back. American Express prints four digits on the front. The code is not embossed and does not appear on receipts. Its function is to prove that the person entering a card number has the physical card.

Is there a legal place to buy CVV data

No. In the US, 18 U.S.C. 1029 covers access devices, a term that includes card numbers, account numbers, and the codes tied to them. Selling, buying, transferring, or possessing card data with intent to defraud falls under that statute. Penalties under 1029(c) run from fines to prison terms of 10 years, and up to 15 years for certain aggravated subsections.

There is no licensed broker of CVV data. Payment processors, banks, and merchants do not sell it. A site that lists CVV numbers for sale is offering data taken from cardholders who did not consent.

Signals of a carding vendor

Listings that advertise CVV data share a set of features:

  • Bundles of card number, expiry date, CVV, cardholder name, and billing address.
  • Payment in cryptocurrency with no refund path.
  • Bulk pricing and fullz tiers.
  • Instructions to test a card at a charity, donation, or low-value checkout page.
  • Guarantees that replace a card if a charge is declined.

Each item describes stolen data, not a payment service. Test charges at donation sites are card-not-present fraud.

What card networks require from real businesses

PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. The CVV, CVC, and CID fall in that category. A processor that keeps the code after a transaction is not compliant. Legitimate systems use network tokens so a merchant can charge a card without holding the code.

A vendor that claims to be a processor and sells CVV data contradicts the standard it says it follows.

Risk to anyone who buys

Carding markets carry two risks. The first is dead data: cards that were reported stolen and closed. The second is law enforcement. US agencies have operated undercover carding sites and seized market domains. A purchase record on such a site becomes evidence.

What to do instead

  • If you need to accept card payments, apply to a payment processor or acquirer. They run underwriting, and they do not sell card data.
  • If you need card data for testing, use the test card numbers that processors publish for sandbox environments. Those numbers work in test mode only.
  • If a card of yours appears on a forum, call the issuer and request a replacement. The FTC directs victims to IdentityTheft.gov, and the FBI accepts reports through the IC3.