What a CVV listing is
A CVV listing is a record or advertisement that offers stolen card data for sale. It pairs a card number and expiration date with the card's verification value, which is the three digits printed on the back of a Visa, Mastercard, or Discover card, or the four digits printed on the front of an American Express card. These listings appear on criminal forums, chat channels, and paste sites. They do not appear on legitimate retail, banking, or payment sites, because no lawful source holds that data in a form anyone can sell.
Buying, selling, or using a CVV listing violates 18 U.S.C. 1029, the federal access device fraud statute. When the data belongs to a real person, prosecutors can add a mandatory two year consecutive sentence under the aggravated identity theft statute.
What the verification code does
Card issuers generate a verification value to prove that whoever is typing a card number is holding the physical card. Merchants that accept card not present payments, such as online stores and phone order desks, ask for it to reduce fraud. Card networks and the PCI DSS rules forbid merchants and processors from storing that value after a transaction is authorized. That single rule explains why every CVV listing on the market is stolen, fake, or both.
What appears in a typical listing
- Card number and expiration date
- Verification code, often labeled CVV2, CVC2, or CID
- Cardholder name and billing ZIP code
- Sometimes a bank login, Social Security number, or driver license number in bundles sellers call fullz
- A price, a country of issue, and a claim about the card's balance
Many listings are fabricated. Sellers take cryptocurrency up front and deliver nothing. A buyer who pays has already committed a federal offense and has no recourse when the data turns out to be invented.
CVV Enumeration Registry: Understanding and Navigating the Landscape
Legal exposure in the United States
Trafficking in stolen card data carries up to 10 years in prison for a first offense and up to 15 years in aggravated cases. Courts can order restitution to the cardholder and the issuing bank, and state statutes add separate charges for identity theft, larceny, and computer crimes. Holding a listing, whether you bought it or not, counts as possession of an access device with intent to defraud when the surrounding evidence supports that reading.
If your card data shows up for sale
- Open your card issuer's app and lock or freeze the card.
- Call the number on the back of the card and ask the fraud team to close the account and issue a new number, not just a replacement card.
- Read the last 12 months of statements and flag every charge you do not recognize.
- Place a free security freeze with Equifax, Experian, and TransUnion.
- File a report at IdentityTheft.gov and save the confirmation number.
- Report the listing to the FBI Internet Crime Complaint Center.
- Remove the saved card from shopping apps, browsers, and subscription services.
Reducing your exposure
- Pay with a tokenized wallet or a virtual card number that is tied to one merchant.
- Never read your verification code to someone who calls you. Banks do not ask for it.
- Turn on transaction alerts for every charge above a low threshold.
- Check card readers and ATMs for loose panels or extra hardware before you insert a card.
- Type store addresses by hand instead of following links from email or text messages.
The short version
There is no legitimate CVV market. Any site, seller, or channel that offers card verification values is trading in stolen financial data, and the penalties fall on the buyer as well as the seller.