There is no legitimate shop, vendor, or marketplace that sells CVV numbers or "fresh dumps." Every storefront advertising them is either a criminal operation trading stolen payment credentials or a scam that takes money from people trying to buy them. In the United States, buying, selling, or holding stolen card data is a federal crime, and the typical result of pursuing it is lost funds, exposed personal identity, or a federal investigation. If you need card data for a lawful purpose, such as accepting payments or building checkout software, the legitimate path runs through a payment processor, an acquiring bank, and PCI DSS compliance. Nothing about that path involves a storefront that sells CVVs.
What "CVV shop" and "dumps" actually describe
The terms describe underground trade in payment card data. A CVV is the three or four digit verification value printed on a card, and a dump is a copy of the magnetic stripe or chip data. Legitimate businesses never sell these values. The CVV exists so the issuing bank can confirm the physical card is present during a transaction. When a merchant or processor stores that value after authorization, it becomes a breach liability rather than a business asset. Listings that promise "fresh" inventory are describing data taken from a breach, a skimmer, or a phishing page, not a product anyone is licensed to distribute.
The legal exposure in the United States
Federal law treats stolen card credentials as unauthorized access devices. Trafficking in them, using them, or possessing them with intent to defraud carries serious penalties, including prison time and restitution, and prosecutors can stack additional wire fraud and identity theft charges on top. State laws add their own counts. There is no version of this activity that is legal because the buyer did not perform the original theft. Purchasing the data is itself the offense.
Why these storefronts are usually scams
Operators of these sites know buyers cannot complain to anyone. Common patterns include requiring a deposit before showing any data, sending invalid or already-used numbers, and logging the buyer's own payment or identity details for later misuse. Some sites exist only to collect cryptocurrency from people who are already breaking the law. The customer has no recourse, no refund, and no way to verify inventory before paying.
What to look for if you handle card data legitimately
- A written agreement with a processor or acquiring bank that defines what data you may receive, store, and transmit.
- Tokenization, where the processor returns a surrogate value instead of the card number so your systems never hold the real one.
- Sandbox test credentials issued by the processor for development, which are the only lawful way to test checkout flows.
- A current PCI DSS attestation and a documented data retention policy that prohibits storing the CVV after authorization.
- Access controls and logging that show who touched card data and when.
Signals that separate a compliant service from an illegal one
Ask where the data comes from. A compliant provider can point to a cardholder authorization, a merchant agreement, or an issuer relationship. Ask what is stored. A compliant provider deletes or never receives the verification value. Ask who is liable. A compliant provider carries a contract with defined responsibilities. When any of those answers is vague, the answer is no.
Common pitfalls
- Assuming a marketplace is safe because it has reviews or a polished interface. Criminal sites invest in appearance.
- Believing that buying data rather than stealing it lowers the risk. It does not.
- Testing live card numbers instead of processor sandbox credentials, which can violate network rules and trigger fines.
- Storing verification values in logs, support tickets, or spreadsheets during troubleshooting.
- Ignoring chargeback and fraud monitoring until losses force a review.
How consumers and merchants should respond to card fraud
Consumers who find unauthorized charges should contact the card issuer first, then file a report with the Federal Trade Commission and, when the activity involves an online scheme, the FBI Internet Crime Complaint Center. Merchants who suspect they were breached should notify their acquirer and processor, preserve logs, and bring in a qualified incident response assessor. Speed matters because card networks set deadlines for reporting and for demonstrating compliance after an incident.
FAQ
Is it legal to buy CVV numbers anywhere in the US?
No. Purchasing, selling, or possessing stolen card credentials is a federal offense, and the buyer is exposed to the same statutes as the seller.
Are the numbers sold on these sites actually valid?
Sometimes, briefly, and often not at all. Even valid numbers were obtained unlawfully, and many listings are fabricated to take the buyer's money.
Can a merchant test card numbers lawfully?
Yes, using test credentials supplied by a payment processor in a sandbox environment. Those numbers are not real accounts and cannot be used for live charges.
What should a business store after a transaction?
The authorization result, a token, the last four digits, and the card brand. The full number and the verification value should not be retained after authorization.
Where do people report a site that claims to sell card data?
Reports go to the FBI Internet Crime Complaint Center, the FTC, and the card issuer or network involved. Include any domain names and payment details you observed.