What the listings are
"CVV dumps for sale" listings offer stolen card data: the card number, the expiration date, and the three or four digit verification code. That code sits on the back of most cards and on the front of American Express cards. Sellers price records low to move volume. The product is stolen data. This article does not list sellers, prices, or purchase methods.
Legal status in the US
Federal law covers this under 18 U.S.C. Section 1029. That statute bans the sale, transfer, and possession of card credentials with intent to defraud. Penalties reach 10 years for a first offense and 15 years for a repeat offense or for conduct involving $1,000 or more in a 12-month period. State laws add identity theft and computer crime charges. Buying is not a lesser offense than selling. A purchase is evidence of intent.
Buying CVV Protection, Not Card Data: A Security Buyer's Guide
How the offers work
Most listings are fraud against the buyer. Common patterns:
CVV Codes, Dumps, and High-Balance Offers: A Shopper's Security Guide
- The seller takes cryptocurrency and sends nothing.
- The seller sends card numbers that were closed or reported lost months ago.
- The seller resells one record to many buyers, so the number fails on first use.
- The seller keeps buyer contact data and uses it for extortion.
Buyers have no refund path and no dispute process. A complaint to law enforcement is a confession.
What buyers risk
Card networks and issuers score every authorization attempt. Declines and chargebacks tie back to the IP address, device, and account used. Federal agents use those records in prosecutions. A person who buys dumps and uses one card can face federal charges, restitution, and a permanent record.
How card data leaks
Data reaches these markets through skimmers on fuel pumps and ATMs, breached merchant payment systems, phishing pages, and malware on checkout pages. Verification codes are also taken by phone and email, when a caller asks the holder to confirm the code.
Protection steps for cardholders
- Use a virtual card number for online purchases when the issuer offers one.
- Turn on transaction alerts for every charge above a set amount.
- Freeze the card in the issuer app when it is not in use.
- Check card readers at fuel pumps and ATMs for loose or added hardware.
- Never read the verification code to a caller. No bank or merchant asks for it.
Protection steps for merchants
Require CVV verification on card-not-present orders. Use 3-D Secure for high-risk orders. Match the billing address and ZIP to the issuer record. Review any order that ships to an address other than the billing address.
Report card fraud
Report the charge to the issuer first. Then file with the FTC and the FBI Internet Crime Complaint Center. Keep the card and the statements until the case closes.