CVV Shops and Stolen Card Data: Legal Status in the US

No buying guide for stolen card data

A "CVV shop" is a storefront that sells stolen payment card data. Listings carry card numbers, expiration dates, cardholder names, and security codes. Sellers collect the data from skimming devices, phishing pages, and breaches of merchant databases.

Buying that data is a crime in the United States. 18 U.S.C. Section 1029 covers trafficking in unauthorized access devices. A conviction carries up to 10 years in prison and a fine. 18 U.S.C. Section 1028A adds a mandatory 2-year term that runs after the fraud sentence when the offense uses another person's identity. Card issuers void fraudulent charges. Banks, merchants, and card networks investigate each chargeback and file reports with law enforcement.

Two facts shape the risk for anyone who buys from these shops:

• Shops get seized. Operators get charged. Payment records, IP logs, and chat histories go to investigators with the case file.
• Payments move through traceable channels, including cryptocurrency that exchanges tie to identity documents.

Cardholders who find unauthorized charges should call the card issuer, then report the incident at IdentityTheft.gov. The FTC publishes recovery steps for payment card fraud. The FBI Internet Crime Complaint Center collects complaints that feed into federal investigations.