Buy CVV Online: It's Card Fraud and a Scam | What to Know

There is no legitimate market for CVV data

A CVV is the three or four digit code on a payment card. It exists so a merchant can check that whoever is typing the number is holding the physical card. That single purpose is why no honest seller exists. The only party allowed to hand you a CVV is the bank that issued the card, to its own cardholder. Anyone else offering one is moving a record of somebody else's stolen account, and that is what you are actually buying.

So when a site promises "fresh CVVs, high balance, instant delivery," read it as a description of a crime, not a product listing.

The legal picture in the United States

Buying, selling, or holding card numbers with intent to defraud falls under 18 U.S.C. § 1029, the access device fraud statute. Most counts carry up to 10 years in federal prison, with higher ceilings for aggravated conduct, plus fines and restitution. Prosecutors charge buyers as well as sellers. A conviction does not care that you were "just testing" or that the number never worked.

Card networks treat CVV storage as a hard no under PCI DSS. Merchants are not permitted to keep the code after authorization. That rule exists precisely because the code is the part worth stealing, and the industry closes the door on purpose.

Why these shops are a bad deal even on their own terms

• Deposit first, product never. You fund a wallet in crypto before you see a single number. There is no escrow, no chargeback, no support desk, and no identity behind the site.
• Resold inventory. The same record gets sold to dozens of buyers. The first person who tries it kills the card for everyone.
• Checkers are bait. Tools that promise to verify a card before you buy are a common delivery method for credential stealers and clipboard hijackers.
• You are the mark. Operators keep logs of wallet addresses, IPs, and anything you typed into the account form. Some of them later use that against you.
• Exit scams are the norm. A shop builds a reputation on a forum, takes a run of deposits, and disappears. That is the business model, not a failure of it.

What people in this search are usually trying to do instead

Most honest reasons to want card numbers for card-not-present work have a legal path. If you are building checkout flows, every major processor publishes sandbox test cards for that purpose. If you need disposable card numbers for ad spend or vendor trials, virtual card issuers will hand you real, funded numbers tied to your own account, with spend limits and a freeze button. If you are a merchant fighting fraud, the tools you want are AVS checks, 3D Secure, device fingerprinting, and velocity rules, not a stack of stolen numbers.

If you already paid one of these shops

Do not send more money to "unlock" the order. That is the second stage of the same scam. File a report with the FBI's Internet Crime Complaint Center and with the FTC, and keep the wallet address, chat logs, and timestamps. If you used a card of your own anywhere in the process, call that issuer and have it replaced.