Answer first
A CVV is a 3-digit or 4-digit code printed on a payment card. It is not a product for sale. Buying, selling, or using card data that belongs to another person is a federal crime in the United States under 18 U.S.C. § 1029. Listings that advertise inexpensive CVV records sell numbers that have been cancelled, reported, or invented. Buyers lose the money they spend and can face prosecution.
Economical CVV Purchase: A Guide
What a CVV does
Card issuers print a verification value on the card: four digits on the front of American Express cards, three digits on the back of Visa, Mastercard, and Discover cards. A merchant asks for the code to confirm that the physical card is in hand. The code is not stored in the magnetic stripe or the chip. Card networks bar merchants from storing it after the transaction settles.
What cheap CVV listings contain
- Numbers from cards already reported lost or stolen.
- Numbers from cards with no remaining credit.
- Numbers pulled from a random number table.
- Records from old breaches that issuers have since reissued.
These listings fail for one reason. Card issuers cancel and reissue cards after a breach. A batch sold for a few dollars per record has a short working life and a high chargeback rate.
Penalties under US law
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A first offense carries a fine, up to 10 years in prison, or both. A second offense raises the maximum to 20 years. Prosecutors can add identity theft counts under 18 U.S.C. § 1028A, which adds a mandatory 2-year term to the sentence. State laws add separate charges and separate sentences.
Consumer protections
Federal rules limit cardholder liability. Under the Truth in Lending Act and Regulation Z, a consumer owes no more than $50 for unauthorized credit card charges, and many issuers waive that amount. Debit card liability depends on how fast the cardholder reports the loss. The FTC advises cardholders to call the issuer, then file a report at IdentityTheft.gov.
What to do instead
If a card number is exposed, report it to the issuer and freeze the account. Review statements for small test charges. Merchants can cut fraud with address verification, 3-D Secure authentication, and velocity checks on card testing patterns.