Selling CVV Data Online: What US Law Says

Selling CVV data is a federal crime in the United States

A CVV is a card verification value. It is the 3-digit code on the back of most Visa, Mastercard, and Discover cards, and the 4-digit code on the front of American Express cards. Card networks use the CVV to confirm that the person entering a card number holds the physical card. A site that advertises card numbers, expiration dates, and CVVs for sale is trading in access devices. In the US, that trade is illegal under 18 U.S.C. § 1029. There is no state or federal license that permits it.

What the term covers

Listings sold on these sites use a short set of labels. The labels describe stolen data, not a product category.

• CVV: a card number plus expiration date plus the verification code. Some listings add the cardholder name.
• Fullz: a record with the cardholder name, billing address, phone number, date of birth, and often a Social Security number.
• Dumps: data copied from the magnetic stripe of a physical card.
• BIN: the first six to eight digits of a card number. It identifies the issuing bank and card type.

Penalties under federal law

18 U.S.C. § 1029 sets a maximum of 10 years in prison for most access device offenses. Trafficking offenses where the value of the devices exceeds $1,000 in a one-year period carry a maximum of 15 years. 18 U.S.C. § 1028A adds a mandatory 2-year prison term for aggravated identity theft, and that term runs consecutive to the sentence for the underlying crime. Federal sentencing guidelines calculate the range from the dollar loss under USSG §2B1.1.

State charges can follow the same conduct. Prosecutors file under state identity theft, forgery, and computer crime statutes when the loss stays inside one state.

Why stored CVVs violate card network rules

PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after a transaction is authorized. The CVV is sensitive authentication data. A merchant or payment processor that keeps CVV data after authorization is outside card network rules, and it can lose the ability to accept card payments. Sites that hold CVV data for resale hold it in violation of those rules and of federal law.

Most of these sites do not deliver

Buyer complaints filed with the FBI Internet Crime Complaint Center describe the same pattern. The operator collects payment in cryptocurrency, then sends invalid card data or nothing. The buyer cannot report the loss to law enforcement without admitting to the attempted purchase. The site itself is the fraud.

How to report card fraud

1. Call the card issuer. The number is on the back of the card. The issuer can freeze the account, reverse unauthorized charges, and mail a new card with a new number.
2. File a report at IdentityTheft.gov, operated by the Federal Trade Commission. The site produces a personal recovery plan and an FTC Identity Theft Report.
3. File a complaint with the FBI Internet Crime Complaint Center if the loss involves an online marketplace or cryptocurrency.
4. Place a free fraud alert or credit freeze with the three national credit bureaus if a Social Security number was exposed.
5. File a police report in the city where the cardholder lives. Some issuers ask for a report number before they close a dispute.

Common questions

Is selling CVV data legal in any US state?

No. Every state criminalizes the sale of another person's card credentials or personal identifiers.

What is the difference between a CVV and a card number?

The card number identifies the account and the issuing bank. The CVV proves the person holds the physical card. Both are needed for most online purchases.

Does a new card number stop the problem?

It stops charges on the old number. It does not remove data that was already copied from a merchant, a processor, or a card skimmer.