Short answer
You cannot buy card test data or CVV data from a legitimate source. Listings advertised as "card test data v3," "fresh CVV," or "checker ready dumps" are stolen payment credentials. Buying, selling, or using them breaks federal law in the United States and violates card network rules, and the seller is often running a scam on top of the theft. If your actual goal is to stop card testing against your own store, the thing to purchase is fraud prevention software from an established payment provider, not a data file.
Card Test Data V10: How to Buy CVV Safely
What the phrase usually refers to
Card testing is an attack, not a product. Someone with a batch of stolen card numbers sends small authorization requests to a merchant to find out which numbers still work. The merchant eats the authorization fees, the declines, and often the chargebacks. When you see a file marketed as test data, it is a batch of numbers plus expiration dates, and sometimes CVV values or cardholder names, packaged for that same attack.
The variants differ in detail, not in legality:
- Card numbers with expiration dates only
- Full records with CVV or CVV2 values attached
- Bulk lists sorted by bank identification number or country
- Access to a so called checker, which is a script that automates the probing
Legal exposure
Possession is not the only issue. Trafficking in stolen access devices, access device fraud, and identity theft statutes all cover buying card data, reselling it, or using it to run test authorizations. Penalties can include prison time and fines. Card networks also fine acquiring banks, and those fines reach the merchant through processing fees or account termination. Practical reality matters too. Sellers in this market routinely take payment and deliver nothing, deliver already burned numbers, or log the buyer and use that record later.
What legitimate merchants should buy instead
If you operate a store and card testing is hitting your checkout, evaluate fraud tooling on these points:
- Velocity rules that cap authorization attempts per card, per device, and per IP address
- Address verification and CVV verification enabled at the gateway level
- Support for 3D Secure or another step up authentication on risky orders
- Risk scoring that reviews new accounts, mismatched billing data, and unusual geographies
- Reporting that separates card testing declines from ordinary declines
Reasonable starting thresholds
Most processors suggest limiting repeated authorization attempts on one card to roughly three to five per hour, capping attempts per IP address in the low tens per hour, and flagging any account that adds several payment methods within minutes. Tune these upward only if your business model genuinely produces that pattern.
Pitfalls
- Buying a list to "test" your own gateway. It is still stolen data.
- Blocking only by IP address. Attackers rotate through proxy pools.
- Ignoring small dollar authorizations. Testers favor them because they look harmless.
- Turning off CVV checks to raise approval rates. This removes your cheapest filter.
FAQ
Is card testing a felony in the US?
It can be prosecuted as access device fraud or identity theft, both of which carry felony exposure depending on the amounts and prior record.
Can I be liable if a stolen card is used on my site?
You can lose the sale, pay chargeback fees, and face network fines if the volume is large or repeated.
Where do I report a seller?
Report to the FBI Internet Crime Complaint Center and to your card network's fraud contact.