What "cheap CVV" listings are
Listings that advertise the sale of CVV data cheap offer stolen payment card records. Each record holds a primary account number, an expiration date, and a card verification value. In the United States, 18 U.S.C. 1029 covers the sale, transfer, and possession of access devices with intent to defraud. A first offense carries up to 10 years in prison. A second offense carries up to 15 years. Fines for an individual reach $250,000.
Selling CVVs on the Dark Web: Why 'No Scam' Offers Are Always Fraud
The price is low for a reason. A card record stays usable only while the account is open and the issuer has not flagged the account. Cardholders freeze a card from a banking app in seconds. Issuers close accounts after one stolen-card report. Data from a breach has a shelf life measured in days, and a vendor who sells one record to 50 buyers shortens it further.
How to Sell CVV Cheap on Dark Web: Illegal Card Fraud, Not a Buying Guide
Parts of a card record
- PAN: the 16-digit account number on Visa, Mastercard, and Discover cards; 15 digits on American Express.
- Expiration date: month and year.
- CVV2: the 3-digit code on the back of most cards.
- CVC2: the 4-digit code on the front of American Express cards.
PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization, including CVV2 and CVC2. A bulk file of card verification values came from a system that broke that rule.
how to sell cvv cheap on dark web
Where card data leaves a system
- Skimming devices on fuel pumps, ATMs, and point-of-sale terminals.
- Phishing pages that copy a checkout form.
- Injected scripts on merchant payment pages.
- Breached databases at merchants and payment processors.
Controls to buy, and what to check
- 3-D Secure version 2. Ask the processor for the authentication rate and the liability shift terms. Without authentication, the merchant absorbs the fraud loss.
- Network tokenization. Confirm the token replaces the PAN in storage, in transit, and in mobile wallets.
- Address Verification Service and CVV check. Track the false decline rate against the fraud rate.
- Payment page script monitoring. PCI DSS 4.0 Requirements 6.4.3 and 11.6.1 took effect on March 31, 2025.
- Velocity limits on card numbers, IP addresses, and device identifiers.
Pitfalls
- Storing CVV2 or CVC2 for subscriptions or "convenience." Requirement 3.2 prohibits it.
- Treating a low fraud rate as proof of safety. Test charges of $1 or less often come before a large order.
- Buying card records to hit a revenue target. Federal prosecutors charge buyers and sellers under the same statute, and crypto payments do not block blockchain analysis.
- Ignoring chargeback ratios during the 3-D Secure rollout. Issuers review ratios above 0.9% of transactions.
Cardholders can limit exposure with virtual card numbers, per-transaction alerts, and a card freeze. Report a stolen card number to the issuer and to the FTC at IdentityTheft.gov.