Selling CVV dumps with PIN is a federal crime in the United States, not a product category. The phrase describes stolen payment card data: a "dump" is a copy of the magnetic stripe from a card, and the PIN is the debit card passcode. No legitimate business sells them, and a listing that claims to is either a scam or evidence of a crime.
What is a CVV dump?
A dump is a text file that copies the data from a card's magnetic stripe, track 1 and track 2. Track 2 holds the card number, expiration date, service code, and a discretionary field. That field can carry a card verification value used for stripe transactions, which is where the slang "CVV dump" comes from.
The three-digit code on the back of your card is not in that file. That code (CVV2 or CVC2) exists for card-not-present purchases. Mixing the two terms is common on carding forums, and the mix-up is one sign that a "seller" is copying phrasing instead of handling real data.
Where does the PIN come from if it is not on the stripe?
A debit PIN is never written to the magnetic stripe. It travels as an encrypted PIN block between a terminal and an issuer, protected under standards like PCI PIN and DUKPT key management. Anyone holding both a stripe dump and the matching PIN got them from two separate captures.
The usual pair is a skimmer on the card slot plus a camera or overlay on the keypad. Tampered point-of-sale terminals and swapped PIN pads produce the same result. That is why "dumps with PIN" listings exist at all: the PIN is the hard part, and it comes from a skimming operation, not from a database leak.
Why selling CVV dumps with PIN is a crime in the US
18 U.S.C. § 1029 covers access device fraud, and it applies to producing, selling, transferring, or possessing card data with intent to defraud. A first offense carries up to 10 years in prison plus fines. Aggravated cases and repeat offenses carry more.
18 U.S.C. § 1028 adds identity theft charges, which bring a mandatory two-year term that runs consecutive to other sentences. Issuers and processors also sue for losses, and courts order restitution. State laws stack on top, and many cover possession of skimming tools as a separate crime.
Why most of this trade is fraud against the buyer
Advance-fee scams dominate the space. The "seller" takes crypto, delivers nothing, and moves to a new handle. Escrow offers on carding forums are run by the same people.
Some listings are posted by investigators. Payment card task forces and FBI field offices monitor these channels, and a purchase message is evidence. Treat any offer as a trap in both directions: you lose money, or you become a defendant.
How banks spot PIN-and-stripe fraud
- A PIN change followed by a cash withdrawal within minutes.
- ATM withdrawals in a city far from the cardholder's normal pattern.
- Several cards used at one terminal in a short window.
- Stripe transactions on a card that has an active EMV chip.
- Chargebacks filed within days of a skimmer report at a local merchant.
These rules run in real time. Issuers block the card and close the account before the cash leaves the ATM in many cases.
What the phrase signals to a payment security team
For a merchant or processor, "dumps with PIN" points to a physical breach, not a website breach. The data came from a terminal, an ATM, or a fuel pump. Terminal seals, keypad integrity, and technician visits matter more than firewall rules in that case.
PCI PIN rules exist for this reason: key management, device inspection, and split knowledge for anyone who touches a PIN pad. A merchant that skips those checks becomes the source of the next dump.
What to do if you find a listing or your card is compromised
- Report the listing to the FBI's Internet Crime Complaint Center.
- Call your card issuer, freeze the card, and dispute any charge you do not recognize.
- File a report with the FTC's identity theft portal if your data was used.
- Check the ATM or terminal you last used for loose card slots, extra cameras, or a keypad that feels thick.
Speed matters with debit cards, because a drained checking account takes longer to restore than a frozen credit line.
How to keep your PIN and card data out of a dump
- Cover the keypad with your other hand, every time.
- Use the chip reader or contactless instead of swiping.
- Pay with credit, not debit, for online orders.
- Use virtual card numbers from your issuer for subscriptions and one-off sites.
- Turn on transaction alerts for any charge above a threshold you set.
- Wiggle the card reader at a fuel pump before you use it. Loose housings are a common skimmer sign.
Frequently asked questions
Is it legal to sell CVV dumps with PIN?
No. Selling or transferring card data with intent to defraud violates 18 U.S.C. § 1029 in the US and similar laws in most countries. Penalties include prison, fines, and restitution.
Does a dump include the PIN?
No. The magnetic stripe does not store the PIN. A listing that pairs both means someone skimmed the card and captured the keypad entry.
What happens to the buyer?
The buyer commits a federal offense even if the data never works. Most buyers also lose the payment, since advance-fee scams are the norm.
How do I report a fraud listing?
Send it to the FBI's Internet Crime Complaint Center and to the card network whose brand appears in the listing. Both keep tip lines for this.