What a CVV Is
A CVV is a 3 or 4 digit code printed on a payment card. Visa, Mastercard, Discover and American Express use it to check that the person entering a card number in a card-not-present transaction holds the physical card. The code is not stored in the magnetic stripe or the chip.
PCI DSS Requirement 3.2 forbids merchants and processors from storing the CVV after an authorization. Anyone holding a large file of card numbers paired with CVV codes holds data that no legitimate business is allowed to keep.
Why There Is No Legal Seller
A file of card numbers with matching CVV codes is stolen payment data. It has no lawful use. There is no licensed dealer, no wholesale price list, and no consumer protection for a buyer. Sites that advertise this material fall into two groups: they sell data taken from other people, or they take payment and deliver nothing.
Under 18 U.S.C. 1029, selling, transferring or possessing access devices with intent to defraud is a federal crime. Penalties reach 10 years for a first offense and 15 years for repeat offenses or offenses involving more than $1,000 in value. 18 U.S.C. 1028A adds a mandatory 2 year sentence, served consecutively, when a stolen identity is used during the fraud.
What Happens to Buyers
Cardholders dispute unauthorized charges. Issuers reverse the charge and open a fraud case. The transaction record, the IP address, the device fingerprint and the delivery address stay with the payment processor. Federal agents have used those records in prosecutions.
Buyers who pay a seller in cryptocurrency lose the funds. No court enforces a contract for stolen data. The Federal Trade Commission reports card fraud as the most common identity theft category in its Consumer Sentinel data.
Lower-Risk Alternatives
- Virtual card numbers from your own bank or card issuer, issued for a set merchant or a set limit.
- Prepaid cards bought at a retail store for online spending.
- Single-use card features offered by major issuers at no cost.
These tools give the same separation between your main account and an online merchant. They are legal and the issuer handles disputes. Unknown: any figure on how much money buyers lose to fake CVV vendors, because most victims do not report the loss.