Credit card CVV leaked: what it means and what to do
Risk level: critical. Can you change it: yes. Found in 2 breaches in this directory.
What this data is
The three or four digit security code printed on your card, also called CVC or CID, which online shops ask for to show you hold the physical card.
The risk on its own
A code on its own is just a short number. This class is critical because card industry rules forbid merchants from storing the code after a payment is authorised, so its presence usually means checkout pages were skimmed and the full card details were captured at the same moment. Treat it as a leak of the whole card.
The risk combined with other data
With the card number, expiry date and your name, a criminal has everything most online shops ask for. The card can be used for purchases, subscriptions and gift cards within hours, or sold on. Your billing address and email in the same record help the fraud pass address checks.
How criminals use it
Small test charges appear first, followed by larger online purchases once the card is confirmed working.
The card is used to buy gift cards or digital goods that are resold immediately.
The details are added to a subscription service or a digital wallet under someone else's control.
A caller claiming to be your bank reads out your card number and asks you to confirm the code and a one-time passcode to stop fraud.
What to do now
Call your card issuer on the number on the back of the card, report the details as compromised and ask for the card to be cancelled and reissued with a new number.
Go through recent statements line by line and dispute anything you do not recognise, including small charges.
Add the new card only to services you actually use, and let unknown subscriptions fail rather than moving them across.
Turn on instant transaction notifications in your banking app, and use card controls to block online or overseas payments you do not need.
Never read a card code or a one-time passcode to anyone who calls you, even if they already know your card number.
Frequently asked questions
Do I really need a new card?
Yes. With the number and code both exposed, cancelling and reissuing is the only real fix. Watching statements alone leaves the card usable by whoever holds the details.
Will I have to pay for fraudulent charges?
Card issuers generally refund unauthorised transactions that are reported promptly. Report quickly and note the date and reference number of your call.
Should a shop even have my security code?
No. Card industry rules say merchants must not keep it after a payment is authorised. Its presence in a breach usually points to skimming code on a checkout page.
Breaches that exposed this data
Genesis Market: 2023-04-05, 8.0M accounts, Browser user agent details, Credit card CVV, Credit cards, Dates of birth, Email addresses, Names
Regpack: 2016-05-20, 105K accounts, Browser user agent details, Credit card CVV, Email addresses, IP addresses, Names, Partial credit card data
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.