Selling CVV Data Online: US Law and Penalties

Short answer

Selling CVV data online is illegal in the United States. A CVV is a card security code issued by the card network. It is not the property of the person who posts it for sale. Buying, selling, or transferring card account data without authorization falls under 18 U.S.C. § 1029, the access device fraud statute. Convictions carry prison terms and fines.

What a CVV is

Visa, Mastercard, and Discover print a three-digit code on the back of a card. American Express prints a four-digit code on the front. The networks call it CVV2, CVC2, or CID. It exists to confirm that the person entering the number holds the physical card during a card-not-present transaction.

Card networks generate the code from the account number and a secret key. A valid CVV cannot be derived from the account number alone. Attackers obtain it through skimming devices, phishing pages, and merchant data breaches.

Federal statutes that apply

• 18 U.S.C. § 1029: fraud and related activity in connection with access devices. Covers trafficking in card numbers and CVVs.
• 18 U.S.C. § 1343: wire fraud. Applies when the internet carries the sale.
• 18 U.S.C. § 1028: fraud and related activity in connection with identification documents.
• 18 U.S.C. § 1028A: aggravated identity theft. Adds a two-year mandatory term consecutive to the underlying sentence.

Penalties

Section 1029 sets a maximum of 15 years for some offenses and 10 years for others, plus fines under 18 U.S.C. § 3571. Sentences increase with prior convictions or losses above set thresholds. Courts order restitution to issuers and cardholders in most cases.

Why merchants cannot store the code

PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That data includes the CVV2, CVC2, CID, the full magnetic stripe, and the PIN block. A merchant that keeps the code after a transaction is out of compliance.

This is also why a stolen code has a short usable life. Issuers decline charges when the code is absent, the card is blocked, or the account is flagged.

Reporting

Cardholders report unauthorized charges to the issuer first. The issuer can reverse the charge and reissue the card. Reports also go to the FTC through IdentityTheft.gov and to the FBI Internet Crime Complaint Center.

What public data does not show

Figures on the size of the stolen card market come from prosecutions, threat intelligence vendors, and network reports. These sources use different methods. No single agency publishes a verified total.