You cannot legally sell a CVV number. A CVV, or card verification value, is the short security code that proves the person paying is holding the physical card, and buying, selling, or brokering CVV data is treated as card fraud and trafficking in unauthorized access devices under U.S. federal law. Anyone offering to show you how to sell CVVs right now is either recruiting you into a felony or running a scam aimed at you.
Sell CVV Right Now: Why That Search Leads to Fraud, Not a Purchase
Is selling a CVV number illegal?
Yes. Under 18 U.S.C. § 1029, it is a federal crime to sell, traffic in, or transfer unauthorized access devices, a category that includes stolen card numbers and their verification codes. Penalties run up to 10 to 15 years in prison, plus fines that rise with the number of accounts involved.
Because these transactions cross state lines and use the internet, sellers usually face wire fraud and identity theft charges as well. Federal agents investigate carding operations directly, and they monitor the same marketplaces where codes are advertised.
Why is a CVV so valuable to criminals?
The CVV is the main defense against card-not-present fraud. Online merchants cannot inspect a physical card, so that code is what separates the real cardholder from someone who only has the account number.
Payment security rules forbid merchants from storing the CVV after a purchase is authorized. A pile of stolen CVVs is therefore proof the codes were captured through skimming, phishing, or a data breach rather than obtained legitimately.
What happens to people who try to sell CVV data?
Buyers in these markets are typically scammers themselves. Many storefronts are staged, and sellers get cheated on payment, blackmailed with their own personal data, or flagged by investigators watching the forum.
Banks trace stolen codes through the purchases made with them, and prosecutors use chat logs, crypto transfers, and device records as evidence. Arrest records routinely show first-time sellers caught within weeks of their first transaction.
How do you protect your CVV when shopping online?
- Shop only on sites with HTTPS and a recognizable payment processor, not checkout pages reached from a social media ad or text message.
- Never type your card number and CVV into a link sent by email, text, or DM. Your bank will not ask for the code.
- Use a virtual card number for subscriptions and unfamiliar stores. It generates a fresh code that is worthless if leaked.
- Cover the keypad and keep your card in sight at terminals, since skimmers copy both the stripe and the code.
- Turn on transaction alerts in your banking app so an unexpected charge reaches you in minutes.
- Freeze your card when you are not using it, which is instant in most bank apps.
How do merchants protect CVV data?
Merchants certified under PCI DSS must encrypt card data in transit, tokenize stored numbers, and never write the CVV to a database after authorization. Tokenization replaces the card number with a surrogate value, so a breach does not yield usable codes.
Address verification, 3-D Secure authentication, and machine-learning fraud scoring add layers on top of the basic code check. No single control is sufficient, which is why card networks require several at once.
What should you do if someone has your card number and CVV?
Call the issuer immediately, ask for the card to be closed and replaced, and review your statements for charges you do not recognize. In the U.S., credit card liability is capped at $50 and is often $0 when you report promptly, but the clock starts when you notice the problem.
Report the incident at IdentityTheft.gov and file a police report if the losses are significant. A new number and a new code shut down most misuse right away.
Can you sell your own CVV for money?
No legitimate service buys a card's verification code, and cardholder agreements prohibit sharing it with third parties. Offers to rent your card or code for a fee are money-mule and fraud schemes that leave you holding the liability.
If someone approached you about selling CVVs, stop communicating and report the conversation to the FTC or the FBI's Internet Crime Complaint Center.