The short answer
There is no legitimate buying guide for CVV data, because buying, selling, or using someone else's card verification value to authorize a transaction is access device fraud under 18 U.S.C. 1029 in the United States and under comparable statutes elsewhere. What can be explained is the rule set itself: how card networks and payment processors treat CVV during authorization, what merchants are allowed to keep, and where verification breaks down. The practical takeaway is that CVV is a weak verification signal, not proof of identity, and the rules built around it focus on two things: forcing a decline when the value does not match, and forbidding storage of that value after the authorization is complete.
What CVV and CVV2 actually are
The three digit value printed on the back of a Visa, Mastercard, or Discover card, and the four digit value on the front of an American Express card, is generated by the issuer from the account number, an expiration date, and a secret key. It is never stored in the magnetic stripe or the chip. Because it is not in the stripe, a card cloned from skimmer data will not carry a valid CVV2, which is the entire reason the field exists in card not present channels.
The rules that govern CVV use
- Merchants may pass CVV2 in an authorization request, but the value may not be retained after the transaction is authorized, per PCI DSS requirements on sensitive authentication data.
- A mismatch response from the issuer is a decline signal. Networks allow the merchant to decide whether to accept a mismatch, and the chargeback liability shifts if they do.
- Storage of CVV2 in a database, log, or order record is a compliance failure even when the transaction was legitimate.
- Processors must not echo the value back in authorization responses or settlement files.
What to check in a live payment stack
Look at the CVV response code split rather than the raw volume. A healthy card not present program usually sees a mismatch rate in the low single digits as a share of attempts, and a sudden jump above that points to testing activity or a data quality problem. Watch authorization velocity per card, per device fingerprint, and per IP cluster. Track how often a mismatch is followed by a retry on the same account number, since that pattern is a classic card testing signature. Three Domain Secure or equivalent authentication should be enabled for higher risk segments, because it moves liability in most regions and gives the issuer a second look.
Common pitfalls
- Treating a CVV match as proof the cardholder is present. It is not. It only shows the person knows a value printed on the card.
- Logging full request payloads and capturing CVV2 in the process.
- Configuring the gateway to auto retry on a mismatch, which inflates decline fees and can trigger network monitoring programs.
- Assuming small ticket transactions are safe to approve without authentication. Card testing runs on small amounts.
FAQ
Can a merchant require CVV? Yes, and most do for card not present orders, but a required field does not make the transaction guaranteed.
CVV Fraud Rules Compared to Traditional Credit Card Fraud
Can CVV be stored if it is encrypted? No. Encryption does not change the prohibition on retaining sensitive authentication data after authorization.
What happens to people who trade card data? Prosecution is common. Convictions carry prison terms and restitution, and marketplace operators are routinely charged alongside the buyers and sellers they serve.