Short answer
Selling CVV dumps is a crime in the United States. A CVV dump is a file of stolen payment card data. Trading one carries prison time under 18 U.S.C. § 1029, and the Department of Justice prosecutes these cases. This page covers the law, the data inside a dump, and the card defenses that stop a stolen code from being reused.
What a CVV dump contains
A dump is a set of card records: the primary account number, the expiry date, the cardholder name, and the three- or four-digit verification code. On Visa, Mastercard, and Discover the code is CVV2. On American Express it is CID. The records come from merchant breaches, skimming devices, and phishing pages. Markets that resell them call the activity carding.
The law
- 18 U.S.C. § 1029 covers access device fraud. Trafficking in access devices, which includes account numbers and verification codes, carries up to 10 years for most counts and up to 15 years for certain offenses.
- 18 U.S.C. § 1028A adds a mandatory two-year term for aggravated identity theft. That term runs after the sentence on the underlying count.
- 18 U.S.C. § 1343 covers wire fraud. Penalties reach 20 years and fines.
- Sentencing turns on the loss figure. Courts count both attempted and actual losses tied to the cards sold.
Federal task forces seize the marketplaces as well. Investigations by the FBI and the Secret Service have shut down carding forums, and defendants pay restitution to banks and cardholders.
Why the verification code is hard to store
PCI DSS bars storage of the CVV2 or CID after authorization. The code is sensitive authentication data. It may pass through a processor during a transaction but may not be written to a database afterward. A merchant that keeps it fails an audit. Tokenization replaces the account number with a surrogate value, so a breach of the merchant system yields no reusable card number.
Sell CVV Dumps Step by Step Guide
What cardholders can do
- Read statements for small test charges.
- Turn on transaction alerts in the issuer app.
- Use a virtual card number for online purchases.
- Report an unauthorized charge to the issuer. Liability for credit card fraud is capped at $50 under the Fair Credit Billing Act.
Businesses report breaches to the FBI Internet Crime Complaint Center. Total reported losses in the 2023 IC3 report passed $12.5 billion.