Sell CVV Online Website: Why It Is a Crime (Guide)

Short answer

There is no legitimate website where you can sell CVV numbers. A CVV is a three or four digit code tied to a payment card. That code belongs to the cardholder. Selling card data that belongs to another person is access device fraud under 18 U.S.C. § 1029. A first offense carries up to 10 years in federal prison. Sites that list CVVs for sale are criminal marketplaces. The operators, the suppliers, and the buyers all face prosecution.

What a CVV is

The CVV is a check value. The issuer computes it from the card number, the expiry date, and a secret key that the issuer holds. Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID. The value exists to prove that the person entering a card number holds the physical card.

The code appears in two places. It is printed on the card. The issuer generates it again for each transaction. It does not appear in magnetic stripe data and it does not appear in chip data. A skimmer that copies a stripe does not capture the CVV2.

Why selling a CVV is a federal crime

18 U.S.C. § 1029 covers access devices. That category includes card numbers, CVVs, and account credentials.

• § 1029(a)(2): trafficking in unauthorized access devices during a one year period, with a value above $1,000.
• § 1029(a)(3): possession of 15 or more unauthorized access devices with intent to defraud.
• § 1029(a)(5): producing, trafficking in, or possessing device making equipment.
• Penalties: up to 10 years for a first offense, up to 15 years for a second, and higher maximums when a financial institution is involved.

Prosecutors add counts under 18 U.S.C. § 1028 for identity documents, 18 U.S.C. § 1343 for wire fraud, and 18 U.S.C. § 1956 for money laundering when a site handles payments.

The card industry rule that blocks CVV storage

PCI DSS Requirement 3.2 prohibits storage of the card verification value after authorization. A merchant that keeps CVVs in a database fails an audit. The rule exists because a stolen database of CVVs is a set of ready to use card data.

Tokenization replaces the card number with a reference value. The CVV does not enter the token. That is why a subscription business sends the CVV with the first payment and sends later payments without it.

How enforcement reaches these sites

The FBI treats carding marketplaces as a cybercrime category. Takedowns follow a pattern: an undercover purchase, a server seizure, then charges against administrators and top sellers. Court records from past cases list the site's own escrow logs as evidence. A marketplace that keeps transaction records builds the government's case.

Payment processors flag accounts tied to card data sales. Card networks watch for merchants with high chargeback rates and unusual transaction patterns.

Where card data does move under contract

Card data moves between issuers, acquirers, processors, and merchants under contracts and audits. A payment processor handles card data as a registered service provider. A fraud prevention vendor handles it under a data processing agreement. Neither one sells a CVV as a product.

If you find a site that sells CVVs

Report it to the FBI Internet Crime Complaint Center and to the fraud line of the card issuer. Do not enter card data to test the site.