What a CVV Is
A CVV is a 3 or 4 digit code printed on a payment card. It exists to prove the person entering card numbers holds the physical card. No legitimate issuer sells a CVV on its own.
Card data sold on carding forums comes from breaches, skimming devices, and phishing pages. The seller does not own the card. The buyer does not own the card. Both parties are handling stolen account data.
Legal Position in the United States
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Buying, selling, or using another person's card numbers is a federal crime. Penalties reach 10 years for a first offense and 15 years for repeat offenses, plus fines.
State laws add charges. Banks reverse card transactions. The merchant, not the buyer, carries the loss in most chargeback cases.
Why Sellers Are Usually Scams
- Payment is crypto only. No chargeback exists.
- Contact runs through a Telegram handle that deletes after one message.
- Sample data checks out against nothing. Buyers cannot verify a live card without committing a crime.
- Buyers who complain become targets for extortion. They cannot report the loss to police without admitting to the purchase.
Legitimate Card Testing for Developers
Payment processors and card networks publish free test card numbers. These numbers pass format checks and return fixed authorization responses in sandbox mode. They are not tied to real accounts. Visa publishes its test numbers in public developer documentation. Similar lists exist for Mastercard, American Express, and every major gateway.
PCI DSS rules, set by the PCI Security Standards Council, state that test data must never contain real cardholder data. A sandbox environment enforces this. Teams run Luhn checks, AVS simulation, and declined-card scenarios inside that environment.
If a project needs end-to-end testing with real cards, the path is a merchant account and a processor agreement. That path includes signed terms, KYC checks, and refund rules.
Parameters That Matter for Sandbox Tests
- Card number format: 13 to 19 digits, Luhn-valid.
- Expiry: any future date the sandbox accepts.
- CVV: 3 digits for most networks, 4 for American Express test cards.
- Response codes: processors map specific test numbers to approvals or declines.
- AVS: test street and ZIP values trigger address mismatch results.
Unknown: the exact test numbers change when processors update documentation. Check the processor's developer page for the current list.