CVV Fraud Guide 2025: Card-Not-Present Theft and US Law

What a CVV is

A CVV is a security code printed on a payment card. Visa, Mastercard, and Discover cards carry a 3-digit code on the back. American Express cards carry a 4-digit code on the front. Card networks call this data a sensitive authentication value. It exists to prove that the person entering card details has the physical card.

Where to Sell CVV in 2025

Every cardholder has one. None of them are for sale by the card issuer, the network, or the bank.

2025 CVV Selling Platform Buying Guide

What card-not-present fraud is

Card-not-present fraud is the use of card data when the card is not physically present. This covers online purchases, phone orders, and mail orders. The fraud happens when someone enters account numbers and security codes that belong to another person.

cvv selling platform 2025

This article does not describe how to buy, sell, or obtain card data. That activity is theft. Sites that advertise card data for sale are frequently scams that take payment and deliver nothing, or they are run by law enforcement. Buyers on those sites lose money and expose their own identity and payment trail to the operator.

Federal law

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A payment card and its account data count as an access device. The statute reaches producing, selling, transferring, and possessing card data with intent to defraud. Penalties include fines and prison terms that reach 10 years for a base offense, with longer terms for aggravated conduct and prior convictions.

Prosecutions run in federal court. Cases often involve multiple defendants, forfeiture of proceeds, and restitution to banks and merchants.

What card networks require

• PCI DSS Requirement 3 prohibits storing sensitive authentication data, including the CVV, after authorization. Merchants that keep it are out of compliance.
• Issuers and merchants use fraud scoring, address verification, and 3-D Secure challenges to test transactions.
• Chargebacks shift the loss. A merchant with a high fraud rate can lose the ability to accept cards.

If your card data is used

1. Call the issuer using the number on the back of the card. Ask for the card to be closed and a new number issued.
2. Review the statement line by line and dispute charges you did not make.
3. File a report at IdentityTheft.gov and keep the report number.
4. File a complaint with the FBI Internet Crime Complaint Center if the loss came from an online transaction.

Federal law limits a cardholder's liability for unauthorized charges to $50, and most issuers waive that amount. The financial loss falls on the merchant, the acquirer, or the issuer.