Sell CVV Online: US Law, Penalties, Reporting

Short answer

Selling CVVs online is a federal crime in the United States. No licensed market for card verification values exists. Every site that advertises CVVs for sale is trading stolen payment data. Buyers and sellers face the same charge under 18 U.S.C. 1029.

What a CVV is

A CVV is the 3 digit code on the back of most payment cards, or the 4 digit code on the front of American Express cards. Card networks use it to confirm the card is in hand at the point of sale. The code is not stored in the magnetic stripe or the chip. It sits on the card and in the issuer's records.

A CVV alone does not move money. Card-not-present fraud needs the card number, the expiration date, the cardholder name, and often a billing address. Sellers bundle these fields into a record and price it by card type, issuer bank, and cardholder state.

Federal charges

18 U.S.C. 1029 covers fraud and related activity in connection with access devices. A payment card and its account number count as access devices. The statute reaches production, sale, transfer, and possession of counterfeit or unauthorized access devices, plus trafficking in them.

One count carries up to 10 years in prison and a fine. Cases with multiple cards or multiple victims raise the statutory maximum and the sentencing range under the US Sentencing Guidelines. Aggravated identity theft under 18 U.S.C. 1028A adds a mandatory 2 year term that runs consecutive to other counts.

How the offers look

Listings use terms such as fullz, dumps, and CVV shop. Some sites pose as forums, review pages, or tutorials. Payment runs through cryptocurrency or gift card codes. The card data is stolen. A buyer who uses it commits the same class of offense as the seller.

State law and civil claims

Most states criminalize identity theft and unauthorized use of a payment card. Penalties range from misdemeanor to felony based on the dollar amount. Cardholders and issuing banks can also sue for damages.

If your card data is exposed

• Call the issuer and ask for a freeze or a new card number.
• File a report at IdentityTheft.gov, the FTC recovery portal.
• Report the listing to the FBI Internet Crime Complaint Center.
• Review statements for small test charges.