Selling CVVs on Dark Web Marketplaces: What It Means and Why It Is Illegal

Selling CVVs on dark web marketplaces means trafficking stolen card verification values, card numbers, and expiration dates as criminal inventory. It is not a gray area or a loophole: in the United States it is a federal offense, and both the person who supplies the card data and the person who buys or uses it can be charged.

read more

What "CVV" means in a card-fraud context

CVV stands for card verification value, the short security code printed on a card or generated for digital wallets. Its purpose is to prove that whoever is typing the card number is physically holding the card. When the phrase "sell CVV" appears alongside dark web marketplaces, it refers to reselling that combination of card number, expiration date, cardholder name, and security code so someone else can attempt a purchase.

read more

The underlying data almost always originates from a crime: skimming devices on gas pumps and ATMs, phishing pages that imitate banks, malware on a merchant's checkout system, or breaches of a payment processor. Reselling it is a second crime stacked on top of the first.

how to sell cvv without getting scammed

Why the phrase shows up in search results at all

Most people searching this term fall into three groups, and none of them benefit from going further:

• Curious researchers and journalists who want to understand how card fraud supply chains work.
• Victims who found an unfamiliar charge, searched the terminology on their statement or in a fraud notice, and want to know what happened.
• People being scammed who were approached by someone claiming to sell card data and now suspect the offer was fake.

That last group is large. Offers to sell card data are a standard advance-fee scam. The seller takes payment in cryptocurrency, delivers nothing, and disappears, or delivers card numbers that are already blocked.

The law treats sellers, buyers, and users the same way

United States federal law does not carve out a passive role for the buyer of stolen card data. Several statutes can apply to the same transaction:

• 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Trafficking in counterfeit or unauthorized access devices is a felony.
• 18 U.S.C. § 1343 covers wire fraud, which applies when communications or payments cross state or national lines, as they do on any online marketplace.
• 18 U.S.C. § 1028 covers identity theft and identity fraud when the card data is paired with a real person's identifying information.
• 18 U.S.C. § 1956 covers money laundering, which is how proceeds from card-data sales are typically moved through cryptocurrency.

What the penalties look like

Trafficking offenses under § 1029 can carry a statutory maximum of up to 15 years in prison, and wire fraud carries a statutory maximum of up to 20 years. Sentences depend on the amount of loss, the number of victims, and whether the conduct was organized. A conviction also means restitution, supervised release, and a permanent federal record that closes off many jobs, licenses, and financial services.

The practical risk is not only the courtroom. Payment networks maintain their own fraud databases, and banks close accounts tied to fraud activity. A criminal record for card trafficking follows a person into every background check for the rest of their life.

Who absorbs the loss

Card-data trafficking is not a victimless transaction between two willing parties. The cardholder may spend weeks disputing charges and replacing cards. Small merchants eat chargeback fees and lose the merchandise. Banks raise costs for everyone to cover fraud losses. When card data is combined with a Social Security number or address, victims can face years of identity repair.

Scams that target people looking for these markets

People who go looking for a card-data seller are an attractive target, because they are unlikely to report being cheated. Common patterns include:

• Upfront payment demanded in cryptocurrency with no escrow and no recourse.
• Fake marketplace screenshots and fabricated reputation scores.
• "Test" transactions that are actually attempts to get the buyer to commit a documented offense.
• Threats of exposure after the victim sends money or personal details.

Law enforcement also monitors these spaces, so messages sent to a supposed seller can become evidence.

How to protect your own card data

• Use a chip or contactless tap instead of swiping a magnetic stripe.
• Set transaction alerts in your banking app so unusual charges reach you within minutes.
• Use virtual or single-merchant card numbers for online subscriptions and unfamiliar sites.
• Check card readers and ATMs for loose housings, mismatched panels, or extra hardware around the slot.
• Never give a card security code over the phone to an inbound caller, and never type it into a page reached from a text message link.
• Keep your phone, browser, and banking apps updated so malware has fewer entry points.

If your card data is exposed

1. Freeze or lock the card immediately through your bank's app or phone line.
2. Request a new card number rather than a replacement card with the same number.
3. Review statements for small test charges, which often precede larger ones.
4. Change the password on your bank and email accounts, and turn on two-factor authentication.
5. Place a free fraud alert or credit freeze with the major credit bureaus if identifying information was also exposed.
6. File a report with the FTC at IdentityTheft.gov and with the FBI's Internet Crime Complaint Center, then give the report number to your bank.

Bottom line

There is no legitimate market for selling CVVs. The term describes an illegal trade in stolen payment credentials, and every role in that trade, including buying, carries federal criminal exposure. If you arrived here because of a suspicious charge or a fraud offer, the useful next step is to contact your bank and file a report, not to search for a marketplace.