Want to Buy CVV From a Shop? It Is Illegal | Risks and Legal Options

No, you cannot legally buy a CVV from a shop. Buying or selling card verification values is card fraud under 18 U.S.C. § 1029 in the United States, with penalties up to 10 years per count and up to 15 years in trafficking cases. Sites that sell CVV numbers run as criminal marketplaces, and many of them are scams on top of that.

Every storefront that advertises "fresh CVV dumps" falls into one of two groups: a real fraud market built on stolen card data, or a fake one built to take a buyer's deposit. Both carry legal exposure, and neither offers a refund, a receipt, or anyone to complain to.

What is a CVV and who is allowed to see it?

The CVV is the 3 or 4 digit security code tied to a payment card. Visa, Mastercard, and Discover print 3 digits on the back of the card, while American Express prints 4 digits on the front. Issuing banks generate that code from the account number, the expiry date, and a secret key, so nobody outside the bank can produce a valid one from scratch.

• Issuers hold the CVV to validate card-not-present orders.
• Merchants pass it to the payment processor during checkout and then discard it.
• Card networks forbid any party in the chain from storing it after authorization.

PCI DSS Requirement 3.2 treats the CVV as sensitive authentication data and bans its storage once a transaction is authorized. Even the business that just charged your card is not allowed to keep that code. No legal vendor in the payment chain has CVV numbers to resell, which means every listing for sale came from a breach, a card skimmer, or a phishing page.

What goes wrong when you buy from a CVV shop

The buyer has no protection in this market. Disputes go to the seller, the seller sets the rules, and the seller already breaks the law for a living. A typical purchase ends in one of a handful of ways.

• Dead cards: the account was closed, frozen, or drained before the buyer tried to use it.
• Resold data: the same number is sold to dozens of buyers, so the first charge triggers a block.
• Test numbers: demo card data from a payment gateway is passed off as live account data.
• Exit scams: the shop takes a large deposit, then the domain goes dark.
• Card checks: small test charges hit the victim's account, the bank flags the pattern, and the funds never move.

Payment adds another layer of risk. Crypto does not hide a trail the way sellers claim, and blockchain analysis firms sell tracing tools to investigators. A deposit into a fraud market can become evidence in a case years later.

What are the penalties for buying CVV data?

US law targets both sides of the trade. Section 1029 of Title 18 covers fraud and trafficking involving access devices, a category that includes card numbers, CVVs, and account credentials. Prosecutors stack charges when the facts allow.

• Up to 10 years in federal prison and fines for a first trafficking offense.
• Up to 15 years when the case involves prior convictions or larger scale.
• A mandatory 2 year consecutive sentence under 18 U.S.C. § 1028A when a stolen identity is used to commit another felony.
• Restitution to victims and supervised release after prison.

Other countries punish the same conduct. The UK Fraud Act 2006 covers possession of articles for use in fraud, and EU states enforce similar rules through national criminal codes. Buying card data abroad does not shield a US buyer from prosecution, since the servers, the payment, or the victim bank often sit in the United States.

Investigators do not ignore the demand side. The FBI and DOJ have seized markets including SSNDOB, UniCC, and Ferum Shop, charged their operators, and shut down forums after years of undercover work. Records from those seizures became evidence against users, not just admins.

Who pays the price for a stolen card number?

Cardholders in the US usually get reimbursed, but the harm does not stop there. People spend weeks cleaning up identity theft, disputing charges, and reopening accounts that were closed over fraud flags. Small merchants absorb chargebacks, network fines, and higher processing fees when stolen cards are used on their checkout pages.

Banks pass the remaining cost to everyone else through fees and stricter fraud checks. A card-not-present fraud spike raises decline rates for honest customers, which is why legitimate shoppers sometimes see extra verification steps on ordinary purchases.

Legal ways to get a card number for online payments

Most people searching for CVV shops want a card they can use online without exposing a main bank account. There are lawful products built for that exact need, and they come with the same fraud protections as any other card.

• Virtual card numbers: many banks and finance apps issue single-use or merchant-locked numbers with their own CVV.
• Prepaid cards: sold at retailers and online, loaded with a set balance, with no link to your checking account.
• Business expense cards: issued to employees with spend limits per merchant or per month.
• Processor test cards: Stripe, Adyen, and other gateways publish fake card numbers and test CVVs for developers building checkout flows.

If the goal is to accept payments rather than make them, a payment service provider handles card data for you, and PCI DSS rules keep the CVV out of your own systems. That setup costs less than a fraud charge and it keeps the business running.

Frequently asked questions

Is buying CVV data a felony in the US?

Yes. Trafficking in access devices carries up to 10 years in federal prison under 18 U.S.C. § 1029, and up to 15 years for repeat or large-scale cases. State prosecutors can file separate charges for the same conduct.

Can I look up the CVV for my own card online?

Yes, through your bank's app or website, or by reading the card itself. The code sits on the back for Visa, Mastercard, and Discover, and on the front for American Express. Your bank will never email or text the full code to you, and anyone who asks for it is running a scam.

Why do CVV shops only accept crypto?

Because card networks and banks block merchants that sell stolen data, and a traceable payment would create a record for investigators. Crypto also lets the seller keep a deposit after the goods fail to work. That lack of recourse is the point, not a privacy feature.

What happens if a merchant stores my CVV?

Card networks fine the merchant and can revoke its ability to accept cards, since PCI DSS bans storing sensitive authentication data after authorization. If a breach follows, that stored code turns a data incident into full account takeover for every customer affected.

What should I do if a card shop already took my money?

Talk to a criminal defense attorney before posting details online, since the transaction itself may be a crime. Online fraud reports go to the FBI's IC3 and the FTC, and the money is rarely recovered. Never send a second payment to a site that claims it can unlock the first one.