CVV Shop for Buying: What It Is and Why It Is Illegal

Short answer

A CVV shop is an illegal marketplace that sells stolen payment card data. The CVV is the three or four digit code printed on a card and used in card-not-present transactions. Buying from one of these sites is a federal crime in the United States under 18 U.S.C. 1029. There is no legal CVV shop and no legitimate seller of raw card data.

website to buy cvv

What a listing contains

A record pairs a card number with the CVV, the expiry date, the cardholder name, and a billing ZIP code. Some listings add the bank name, account balance, and phone number. Prices run from a few dollars to several hundred dollars per record. Price tracks the card credit limit and how recent the data is.

website to buy cvv

Why the listings fail

Stolen card data has a short working life. Issuers cancel a card after one test charge or one odd pattern, so a large share of records are dead on arrival. Shop operators also close sites and keep buyer deposits. Forums ban accounts that complain in public. Cryptocurrency payments have no chargeback route, so a buyer who receives dead data has no refund and no recourse.

cvv shop for buying

Penalties

• 18 U.S.C. 1029: up to 10 years for a first offense that involves trafficking in access devices, up to 20 years for a repeat offense.
• 18 U.S.C. 1028A: a mandatory 2 year sentence served after the underlying sentence when card data is used for identity theft.
• Restitution to banks and cardholders, plus forfeiture of devices and funds.

The number of card records in a case affects the sentencing range. Prosecutors also add counts for wire fraud and money laundering when stolen data moves through payment accounts.

How issuers and networks spot it

Banks score each transaction on device fingerprint, IP address, shipping and billing mismatch, and transaction speed. Card networks share fraud alerts across issuers. One declined test charge can trigger a card replacement and an account review. Data breaches at merchants and processors are a main source of the records that feed these shops.

If you receive card data

Do not use it, do not forward it, and do not store it. Note the sender, then report the incident to the FBI Internet Crime Complaint Center. The cardholder bank can take a report as well. Using the data a single time turns a report into a criminal act.

Protecting your own card

• Turn on transaction alerts inside the bank app.
• Freeze the card from the app when it is not in use.
• Use single-merchant virtual card numbers for online subscriptions.
• Check statements each month and dispute charges you do not recognize.
• Report card theft and skimmers to the issuer and to local police.