Short answer
There is no legal way to sell CVV or CVC data online. In the United States, buying, selling, or transferring card verification values falls under 18 U.S.C. § 1029, which covers trafficking in unauthorized access devices. Most offenses under that statute carry prison terms of up to 10 years. Some carry up to 15 years. Fines, restitution, and asset forfeiture are added on top.
The business side also fails on its own terms. Card data sold in these markets is resold to many buyers, and cards get cancelled by the issuer within hours. Buyers lose the money they paid and cannot report the loss to police, because the transaction itself is a crime.
How to Buy CVV/CVC Securely Online: A Buying Guide
What a CVV is
A CVV or CVC is a short code printed on a payment card. Visa, Mastercard, and Discover use 3 digits on the back. American Express uses 4 digits on the front. The code proves the person entering it holds the physical card during a card-not-present purchase.
PCI DSS Requirement 3.2 forbids storing sensitive authentication data after a transaction is authorized. That data includes the CVV, the full magnetic stripe, and the PIN block. A database that holds CVVs is out of compliance by definition, which is why legitimate processors never keep them.
Legal exposure
- 18 U.S.C. § 1029: fraud and related activity in connection with access devices. Applies to producing, selling, or possessing card data with intent to defraud.
- 18 U.S.C. § 1343: wire fraud. Applies when the internet or phone networks are used.
- 18 U.S.C. § 1028A: aggravated identity theft. Adds a mandatory 2-year sentence that runs consecutive to other counts.
Prosecutions are usually federal. Cases commonly involve multiple counts, and sentences stack.
How card-not-present fraud is detected
Issuers score every transaction. Signals include device fingerprint, IP geolocation, shipping address distance from the billing address, velocity of attempts on one card number, and mismatch between the cardholder name and the buyer name. Card testing, where small charges are run to check if a number is live, triggers issuer blocks and merchant alerts fast.
Merchants who accept card-not-present payments use address verification, 3-D Secure challenges, and machine learning risk models. A CVV alone does not pass those checks.
Protecting your own card
- Use virtual card numbers from your issuer for online purchases. They are single-merchant and expire.
- Turn on transaction alerts for every charge over a set amount.
- Do not read a CVV aloud in a public place or send it by text or email.
- Check your statement weekly. Small test charges show up first.
- Freeze the card in your banking app if a charge looks wrong.
Reporting
Report card fraud to the card issuer first, then to the FTC at ReportFraud.ftc.gov and to the FBI Internet Crime Complaint Center at ic3.gov. The FTC uses reports to build cases and publishes data on fraud trends. IC3 reports feed federal investigations. Banks are required to resolve unauthorized charge disputes, and liability for a stolen card number is capped at $50 under federal law in most cases.
Bottom line
CVV data has no legal market. Anyone offering to sell it, or offering to teach the sale, is committing a federal offense and is also a likely source of fraud against the other party. The realistic outcome is a criminal charge, a frozen account, or a lost payment with no recourse.