CVV Shop Card Data: Fraud Law and Penalties (US)

Why this page is not a buying guide

A CVV shop sells stolen card data. That data comes from breaches, skimmers, phishing pages, and merchant leaks. The cardholder never agreed to the sale. Buying the data is a federal crime in the United States, so there are no legitimate parameters, price tiers, or vendor checks to describe.

The law

18 U.S.C. 1029 covers fraud with access devices. A card number, CVV, and expiration date count as access devices. Penalties reach 15 years in prison and $250,000 in fines for an individual. 18 U.S.C. 1028A adds a mandatory 2 years for aggravated identity theft when the data belongs to a real person. One transaction can trigger both statutes.

What buyers face in practice

• Shops are run by criminal groups. Some take payment and send nothing.
• Issuers flag stolen numbers. Charges get reversed and the account gets closed.
• Payment records, wallet addresses, and chat logs become evidence.
• The U.S. Secret Service and FBI run carding cases with overseas partners.
• Conviction carries restitution to the cardholder and the issuer.

Legitimate paths to card data

A business that needs card numbers for billing uses a payment processor and follows PCI DSS. A consumer gets a card from a bank or credit union. Both paths include the cardholder's consent. No legal market sells another person's CVV, and no shop can make that sale lawful.