No guide: buying CVV data is card fraud (US law)

Why there is no buying guide here

A CVV is the 3 or 4 digit code printed on a payment card or stored in its chip. It is not a product. It belongs to the cardholder and to the bank that issued the card.

Lists of CVV numbers offered for sale come from one place: stolen card data. Sellers get them through skimming devices, phishing pages, merchant data breaches, and carding malware. Buyers use them to place orders on other people's accounts.

US law

Buying or selling stolen card numbers falls under 18 U.S.C. § 1029, which covers access devices. Penalties run up to 10 years for a first offense and up to 15 years for repeat offenses. 18 U.S.C. § 1028A adds a mandatory 2-year term when identity theft is involved. State laws add charges.

Card networks also treat this as fraud. Visa, Mastercard, American Express, and Discover monitor merchants for card-not-present abuse. Accounts get shut down and funds get held.

What honest buyers do instead

If you need to accept card payments, work with a payment processor. If you need a card of your own, apply with a bank or credit union. If you need virtual card numbers for business spending, ask your bank for a commercial card program. Those are the legal paths.

I won't list marketplaces, forums, or vendors. That guide does not exist here.