First answer: there is no legal place
A CVV is the 3 or 4 digit code printed on a payment card. Card networks call it CAV2, CVC2, CVV2, or CID. Online checkout asks for it to confirm the buyer holds the physical card. That single control is why the phrase "best place to sell CVV online" shows up in search data.
No legal marketplace for CVV data exists. Every service that advertises CVV sales is a criminal operation. Stock on those services comes from skimming devices, merchant breaches, phishing kits, and point-of-sale malware.
Legal position in the United States
18 U.S.C. 1029 covers access device fraud. Trafficking in access devices carries up to 15 years in prison and a fine. 18 U.S.C. 1028A adds a mandatory 2 year term, served after the main sentence, when the offense involves identity theft.
Prosecutions target sellers, buyers, and the operators of the storefront itself. A seller account on a card shop is evidence, not a business.
Card industry rules
PCI DSS v4.0 Requirement 3.3.1 states that sensitive authentication data is not stored after authorization. That set includes the full track, the card verification code, and the PIN block. A merchant or processor that keeps CVV values after authorization fails the requirement. Requirement 4.2.1 covers strong cryptography for card data in transit over open networks.
Enforcement record
The U.S. Treasury sanctioned Try2Check in April 2023. Try2Check was a card validation service that let operators test stolen card numbers in bulk. The FBI and partners shut down card shops including Joker's Stash and UniCC. Each takedown produced indictments. None produced a legal successor.
Options if the goal is security work
- Fraud analysts at issuers review authorization logs and decline patterns. They work from transaction records, not stored codes.
- Penetration testers check checkout flows under a written contract with a defined scope.
- Compliance staff map cardholder data flows and write the PCI scope document.
- Card network staff maintain the rules that define a valid verification check.
Each of these roles pays a salary and carries no prison exposure.
If you find a CVV market
Report it. The FBI runs the Internet Crime Complaint Center. The FTC accepts identity theft reports. Card issuers print a fraud phone number on the back of every card. Banks can reissue a compromised card and reverse confirmed fraud charges.
Data on the size of the carding economy comes from breach reports and seizure filings, so exact totals are unknown.