Can I sell CVV now? No. It's a federal crime in the US.
The short answer is no, and it isn't a gray area. Selling CVV numbers, whether you harvested them yourself or bought them from a reseller, violates 18 U.S.C. § 1029. That statute covers access device fraud, and a card verification value is an access device. Prosecutors don't have to prove you stole the card. They have to show you sold, transferred, or possessed the data with intent to defraud.
I spend a lot of time on payment security, and this question shows up in two flavors: someone who found a carding forum and wonders if it's real money, and someone who got recruited as a go-between. Both paths end the same way. A first offense carries up to 10 years, aggravated cases go to 20, and fines plus restitution stack on top.
What the law actually prohibits
The statute targets "access devices," a category that includes credit card account numbers and the security code that authenticates them. It criminalizes producing, selling, transferring, and possessing those devices with fraudulent intent. That word "transfer" matters. It means you don't need to be the person who skimmed the card, cloned the terminal, or phished the cardholder.
"But I'm only the middleman" does not hold up
Reselling stolen credentials is still trafficking. A broker who never touches a physical card is squarely inside the statute, and federal charging decisions often treat the reseller as part of the same conspiracy as the original thief. There's no small-role exception, and there's no dollar threshold that makes a single sale legal.
Why the CVV is the piece that makes this worse
The CVV exists for one reason: to prove the person entering the number is holding the physical card. Card networks never print it on receipts and never encode it in the magnetic stripe. Because PCI DSS prohibits storing it after authorization, any database or chat log full of CVVs is by definition data that shouldn't exist. That's why possessing a bulk CVV list tends to read as intent, not accident.
What legitimate work with card data looks like
Plenty of people handle card data every day without breaking the law. Merchants, processors, and fraud analysts all operate inside a regulated framework:
- Tokenization, where a random value stands in for the card number
- Network tokens issued by the card networks themselves
- Hosted payment fields, where the CVV goes straight to the processor and never touches your server
- PCI DSS assessments that verify you aren't storing sensitive authentication data
None of that involves selling anything. You get paid for processing payments or protecting them, not for moving credentials to a stranger on a messaging app.
If someone is pushing you to sell or buy CVVs
Walk away and keep the messages. You can report payment credential trafficking to the FBI's Internet Crime Complaint Center, and the FTC publishes recovery steps if your own card was compromised. If a "job offer" asks you to receive funds or card data and pass them along, that's a money mule setup, and it's prosecuted as one.