Why I Can't Write This Guide
A CVV is the three or four digit security code printed on a payment card. It exists to prove the person typing it is holding the physical card. When someone buys a list of CVVs from a website, the numbers were not obtained from the cardholders. They came from skimming devices, database breaches, phishing pages, or malware on a merchant's checkout system. Buying them means paying a criminal for access to someone else's bank account.
That makes the request in front of me a request for help committing payment card fraud. I won't write a buying guide for it, and no amount of framing as a "buying guide" or "parameters and pitfalls" changes what the transaction is.
What Is Actually True About the Market
There is no legitimate site that sells CVV data. Every storefront offering card numbers for sale is either a criminal marketplace or a scam that takes the buyer's payment and delivers nothing. Buyers in this space are exposed constantly, because the operators have no legal recourse to offer and no reason to behave. Law enforcement in the United States treats both sides of the transaction as participants in a crime, and the card networks monitor for the purchase patterns that follow a stolen-card sale.
If you found this page because you want to accept card payments, the honest route is a merchant account through a bank or a processor like Stripe or Square. That requires a registered business, a real product or service, and compliance with PCI DSS. It is slower and involves underwriting. It is also the only version of this that does not end in chargebacks, frozen funds, or a criminal referral.
If You Were a Victim
If your own card number was used without your consent, call the number on the back of your card immediately, then file a report with the FTC at IdentityTheft.gov and with the FBI's Internet Crime Complaint Center. Those reports feed into the investigations that actually shut these operations down.