Why people search this phrase
Search data shows the query "want to sell cvv cheap" comes from two groups. One group holds card data and wants a buyer. The other group wants to buy card data at a low price. In the United States both activities are federal crimes. The market that serves both groups is also a fraud target. Buyers lose money. Sellers get caught or robbed.
What a CVV is
A CVV, also called CVV2, CVC2, or card identification number, is a 3 or 4 digit code printed on a payment card. Visa, Mastercard, and Discover use three digits on the back. American Express uses four digits on the front. The code exists to prove that the person entering the number holds the physical card.
The PCI Security Standards Council classifies the CVV as sensitive authentication data. PCI DSS Requirement 3.2 forbids storage of that data after an authorization. A merchant that keeps CVVs is out of compliance. A merchant that stores CVVs and loses them creates the raw material for the market this search term describes.
Legal exposure
18 U.S.C. § 1029 covers access device fraud. Selling, buying, or possessing card numbers with intent to defraud falls under it. Penalties reach 10 years in prison for most first counts and 15 years for other counts. The Department of Justice has seized card data marketplaces and indicted operators and buyers in the same cases.
CVV/CVC Security for Online Purchases: How to Stay Safe
Parameters that appear in cheap CVV offers
- Price per record. Rates far below the wholesale range signal one of three things: the data is expired, the data is invented, or the seller plans to resell the same record many times.
- BIN and country mix. Sellers list bank identification numbers to suggest quality. A list of BINs is not proof that live accounts back them.
- Refund and replacement terms. These terms have no enforcement. There is no court, no chargeback, and no regulator that will hear the claim.
- Payment method. Crypto and gift card codes dominate. Both are irreversible.
- Volume discounts. Large lots raise the chance that a small share of records work, which keeps the buyer paying while the seller profits from the total.
Pitfalls
The first pitfall is the scam. A large share of these offers come from sellers who collect payment and send nothing, or send a file of random digits. The second pitfall is card testing. A buyer who runs a list against a payment page leaves logs, IP addresses, and device fingerprints. The third pitfall is the mule charge. Moving funds from card fraud adds money laundering counts on top of access device counts. The fourth pitfall is that seized marketplace records become evidence. Buyers in past cases learned about the seizure from the indictment.
If card data reaches you
Do not use it, do not forward it, and do not sell it. Preserve the message or file, then report the contact to the FTC fraud reporting service and to the FBI Internet Crime Complaint Center. If you run a store, contact your payment processor and your acquiring bank. Move stored payment data to a PCI DSS validated tokenization service. Tokens replace the card number, so a breach exposes tokens instead of working account data. Visa and Mastercard both publish tokenization guidance for merchants. Merchants that follow it remove the asset that this market trades in.