Where to Sell CVVs on the Dark Web: The Honest Answer

The short answer

There is no legitimate place to sell CVVs, on the dark web or anywhere else. Selling card verification values for cards you do not own is payment card fraud, and every venue that advertises itself for that purpose is one of three things: a scam run by people who intend to rob you, a law enforcement operation, or a forum that will be seized or abandoned within a year or two, usually with its user list published afterward.

If you are asking because you want to understand the ecosystem rather than join it, that question has a real answer and it is worth being blunt about.

What "CVV" actually means in this context

The CVV is the three or four digit code printed on a card, meant to prove the person typing the number is holding the plastic. In the fraud economy the term has drifted. A "CVV" listing usually means full card-not-present data: number, expiration, cardholder name, sometimes billing address. Related inventory includes dumps (magstripe data copied from a skimmer) and fullz (a complete identity record with Social Security number, date of birth, and address).

None of that inventory belongs to the person selling it. It was skimmed from a gas pump, pulled from a breached merchant database, or phished from a customer. That is the part the sales pitch skips.

Why the marketplaces do not work the way they are advertised

• Escrow is fiction. The escrow service is almost always owned by the same people running the shop. When a dispute happens, the escrow holder decides, and the escrow holder is the house.
• Reputation is purchasable. Vendor scores and "verified" badges are sold, farmed with fake buyers, or simply edited by admins.
• Admins rob their own users. The standard ending for a carding forum is an exit scam where the operator drains escrow balances and disappears, sometimes posting the user database on the way out.
• Payment rails are traceable. Bitcoin and most alternatives leave a permanent public ledger. Investigators have gotten very good at following funds to exchanges, and exchanges have know-your-customer records tied to real identities.
• Automated shops are honeypots. A clean-looking storefront that sells card data at suspiciously low prices and accepts anyone with no vetting is a cheap way for an investigator to collect a list of buyers.

How sellers get caught

Undercover buys are routine. Postal inspectors intercept packages of goods bought with stolen numbers, which ties a physical address to a card number. Chain analysis links crypto payouts to accounts that were verified with a driver's license. Forum administrators get flipped after an arrest and hand over logs. Europol and the FBI have run coordinated takedowns of carding infrastructure that pulled in operators across multiple countries at once.

The common thread: sellers are rarely caught because of brilliant forensics. They are caught because they trusted an anonymous stranger who was not anonymous.

What US law says

Trafficking in unauthorized access devices falls under 18 U.S.C. § 1029, which carries up to 10 years in prison for a first offense and 15 years for certain aggravating conduct. Wire fraud under 18 U.S.C. § 1343 adds up to 20 years. Aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory two-year sentence that runs consecutively to whatever else is imposed. Courts also order restitution to the banks and cardholders.

Prosecutors do not need to prove you personally used a card. Possessing or selling the data with intent to defraud is enough.

If your actual goal is money

Security research pays. Bug bounty programs from major platforms pay real bounties for finding card-handling flaws in payment flows, and you never touch anyone's account. If you are a merchant and card data landed in your system through a breach, the move is to notify your acquirer and the card networks, not to shop it around. If card data reaches you by accident, delete it and report it.

If someone is trying to recruit you

The offer usually sounds like this: keep a portion of the funds, buy gift cards, receive a package and reship it. That is a money mule setup, and the person prosecuted is the one in the US with a bank account in their name, not the person messaging from overseas.

Bottom line

There is no safe venue, no honest escrow, and no version of this that ends with you keeping the money. The search results promising a marketplace are the product being sold to you, and you are the inventory.