The short answer
Nothing about selling CVV dumps for money describes a lawful transaction. A dump is a block of payment-card data lifted from a magnetic stripe or skimmed from a checkout page, and every sale of one moves stolen financial credentials. In the United States, trafficking in account numbers falls under 18 U.S.C. Section 1029, the access device fraud statute, and prosecutions reach buyers as well as sellers. If you run an online store and arrived here while researching card security, the useful work sits in three places: keeping the CVV out of your systems once authorization finishes, shrinking your PCI DSS footprint to the smallest possible scope, and watching dispute ratios before the card networks do it for you.
What the term actually covers
Card-data markets use loose vocabulary, and the labels say a lot about how the data was obtained.
Selling CVV Dumps on the Dark Web: Why It Is a Federal Crime
Dumps
Track data copied from a card stripe, usually through a skimmer at a fuel pump, ATM, or POS terminal. Modern chips and network tokens have cut the resale value of this data, which is why stripe skimming has shifted toward older terminals and unattended kiosks.
Fullz
Bundles that pair card numbers with names, addresses, dates of birth, and sometimes Social Security numbers. These are identity theft kits, not payment tools, and they are assembled from breached databases rather than from any single merchant.
CVV-only lists
Generated numbers paired with guessed expiration dates and three-digit codes, produced by automated attacks against weak checkout forms. Most of these lists are noise, which is one reason the marketplaces selling them are full of disputes and exit scams.
Why the trade persists, and why it fails
Stolen card data has no shelf life. Issuers reissue compromised cards, fraud models flag unusual patterns within hours, and authorization rules reject mismatched CVV and address data. A seller has to move inventory fast, which produces the pressure tactics that define these forums: limited batches, vouched buyers, escrow that nobody can audit. Buyers who pay in cryptocurrency have no recourse when the data fails, and the operators who run the storefronts often resell the same records to several people. The result is a market built on fraud against its own participants.
What to look for: signals of a stolen-card marketplace
- Crypto-only payment with escrow run by the same account that owns the shop.
- Claims of a guaranteed valid rate on a batch of card numbers.
- Automated checker tools sold as add-ons to test whether cards are live.
- Invitation-only channels that migrate between messaging apps to avoid takedowns.
- Prices quoted per record rather than per transaction, with no merchant, issuer, or geography detail that a legitimate payment provider would supply.
- Pressure language: fresh base, limited stock, verified vendor badges.
Security parameters that matter for a real checkout
These are the settings and thresholds to build toward, whether you run a storefront or manage payments for one.
- CVV retention: zero. PCI DSS forbids storing sensitive authentication data, including the three or four digit code, after authorization. Do not let it land in logs, order notes, support tickets, or analytics events.
- PCI DSS scope. A hosted payment page or iframe keeps you at a shorter self-assessment questionnaire than a checkout that handles card fields on your own servers. Choose the smaller scope on purpose.
- Network tokens. Replacing the primary account number with a token limits what a breach exposes and keeps recurring billing working after a card is reissued.
- 3-D Secure 2. The added authentication step shifts fraud liability for approved transactions and filters automated card testing before it reaches settlement.
- Dispute ratio. Card networks place merchants into monitoring programs somewhere around a 0.9 percent to 1.8 percent chargeback-to-sales ratio, depending on the program and on volume. Treat 0.65 percent as your internal ceiling.
- Address and CVV verification. Decline or hold orders where the CVV result and the address check both fail. One mismatch with a clean history deserves review, not an automatic decline.
Pitfalls
- Storing the CVV temporarily in a database column for support staff, which turns a routine dispute into a data breach.
- Copying card numbers into spreadsheets, chat threads, or shared inboxes during order review.
- Buying cheap card-testing tools that promise to validate numbers, which puts stolen credentials in your infrastructure.
- Trusting any vendor that markets chargeback-proof processing or dumps traffic as a revenue channel.
- Assuming small stores are not targeted. Automated card testing hits new merchants because their fraud rules are thin.
FAQ
Is selling CVV dumps legal anywhere?
Not in the United States, and most jurisdictions treat trafficking in payment credentials as a serious offense. There is no licensed exchange for stolen card data.
What should I do if my card data shows up for sale?
Report the fraud to your issuer, freeze the card, and file a complaint with the FTC and the FBI Internet Crime Complaint Center. Replace any password reused on shopping accounts.
Can I take card-not-present orders without collecting the CVV?
You can, but you lose a strong fraud signal and take on higher chargeback exposure. Most processors require the code for card-not-present authorization.
What if a partner offers to send dumps traffic to my store?
Refuse it and document the request. That traffic is card testing, and it will damage your dispute ratio, your processor relationship, and your ability to accept cards at all.