Why this page is not a buying guide
A CVV is a three or four digit code printed on a payment card. The card issuer generates that code and ties it to one account. It is not a product, and it is not stocked anywhere. Offers that use the phrase "CVV shop" describe stolen card data, not merchandise.
What the law says
In the United States, 18 U.S.C. 1029 covers access devices. That category includes card numbers and verification codes. Producing, selling, transferring, or possessing them with intent to defraud is a federal crime. A first offense carries up to 10 years; later offenses carry up to 20 years, plus fines. State statutes add separate charges for identity theft and fraud.
The FTC and the FBI both treat bulk card-data sales as a fraud market. Buyers face prosecution, lost funds, and civil claims from issuing banks.
How card data actually moves
Banks issue cards. A merchant receives the number and code from its own customer at the point of sale, then passes them to a payment processor under a card network contract. That is the only authorized path. Any transfer of card data between unrelated parties is unauthorized by definition.
How the solicitations read
- Sellers advertise "fresh" or "valid" rates. No buyer can verify those claims before paying.
- Payment is demanded in a form that cannot be reversed. The buyer has no recourse.
- The seller collects buyer identifiers. Those identifiers become the next target.
What to do instead
To accept card payments, apply for a merchant account through a bank or a licensed payment processor. If your own card data leaked, call the issuer, request a replacement card, and file a report at IdentityTheft.gov. If you received a solicitation, send it to the FBI Internet Crime Complaint Center.
Unknown: no reliable loss figure exists for buyers of fake card data, because victims rarely report. The number is not published by any regulator.