The short answer, before any ranking
Search for the best place to sell CVV online and you will land on pages ranking forums and Telegram channels with names like "fresh base" and "high balance." I have read enough of them to know the pattern. Each listing is either a scam pointed at the seller, a honeypot, or a real criminal market where the only certain outcome is that you handed your identity, your wallet, and your IP address to strangers. There is no version of this trade that ends well for the person selling.
Selling card numbers, CVVs, or full card records you do not own is access device fraud under 18 U.S.C. 1029 in the United States. A first offense carries up to 10 years; aggravated cases go to 15 and 20. That is the only comparison table that matters here.
Why every "CVV shop" fails the same four tests
I run any payment marketplace through the same filters, legal or not, because the filters describe how risk works.
- Escrow that means something. Carding forums offer "escrow" run by the same admins who sell the data. That is not a neutral third party. It is the house holding your money and your handle.
- A counterparty you can identify. Buyers hide behind throwaway accounts. When they dispute a card, they vanish, and you are the one who took the loss.
- Verification of what is being sold. Nobody in that market checks whether a dump is live. If a buyer gets a dead card, the seller gets banned or doxxed. There is no refund process and no regulator to appeal to.
- A way out. Sellers who build a reputation become targets. Exit scams, extortion, and raids on the operators are routine.
What happens to sellers in practice
Cashout accounts get frozen, and banks share that data. Money mule prosecutions pull in people who only moved funds, not people who stole cards. If a marketplace asks you to verify with a selfie or a government ID, you have just built the government's case file for it. Federal prosecutions of carding sellers usually start with the seller's own account records, which the platform kept.
Legitimate ways payment data pays
If the goal is income from the payments world, these are the paths I would take, in order of how quickly they produce recurring revenue.
- Registered ISO/MSP agent. Sell merchant accounts on behalf of a licensed acquirer. You earn residuals on every transaction the merchant processes. Registration with Visa and Mastercard is a published, checkable status.
- Payment facilitator partner. Platforms like Stripe, Square, and Adyen run partner programs for software vendors who want to embed payments. Revenue share, no card data touching your servers.
- PCI QSA or ISA. Assessors who audit merchants against PCI DSS are in constant demand because the standard updates on a cycle.
- Fraud analyst or chargeback prevention. Every large merchant hires people to spot card testing and account takeover. This is the defensive side of the same data.
- Bug bounty programs. Card networks, processors, and fintechs pay for reported flaws in their payment flows. It is the only sanctioned way to touch live card data without authorization.
My pick, then the runners-up
First pick: register as an ISO/MSP agent or join a payment facilitator partner program. The barrier is a background check and a sales pipeline, the residuals compound, and nothing about it requires you to touch a card number. It is the closest thing in payments to what people think a "CVV shop" is selling.
Runner-up: PCI QSA or ISA certification. Slower to enter, harder to fake, and the credentials do not expire into uselessness.
Third: fraud analyst roles at processors and large merchants. Lower ceiling on income, fastest start, and the skills transfer to consulting later.
Checklist before you sign anything in payments
- Is the company listed as a registered ISO or MSP with the card networks?
- Does money settle through a licensed acquirer, or through a shell account?
- Will you ever hold raw card data, or is it tokenized at the point of capture?
- Is compensation residual or a one-time commission?
- Can you name the acquiring bank in writing?
If a pitch fails any of those, walk. A payment business that cannot answer them is not a business. It is a countdown.