There is no legitimate way to sell a CVV together with a PIN. Those two strings are the secrets that authorize a card transaction, so when they appear as a bundled product, the data behind them came from a skimmer, a phishing page, a breached merchant database, or a tampered point of sale device. Anyone offering that bundle is selling stolen payment credentials, and anyone buying it is committing payment card fraud. In the United States that conduct falls under 18 U.S.C. 1029 and the wire fraud statutes. This guide is written from the defense side: what the phrase actually describes, how the data is harvested, and what cardholders and checkout teams can do about it.
What the phrase actually describes
A CVV is the three or four digit verification value printed or generated for a card. A PIN is the secret the cardholder types at an ATM or terminal. They live in different systems, they are issued by different processes, and in a properly designed payment network they should never travel together in one record. When a listing advertises both for the same card, it usually means one of two things. Either the seller has a full card record from a breach and is guessing at the PIN, or the card was captured at a physical device where both the magnetic stripe and the keypad entry were recorded.
That second case is the one that matters most, because it is where the term originated. Skimming hardware that sits over a card slot and a hidden camera or overlay keypad can capture magstripe data and the PIN in the same session. It is a card present attack dressed up as an online one.
best place to sell cvv with pin
How the data gets harvested
Card present skimming
- Overlay skimmers on ATMs, fuel pumps, and self checkout lanes.
- Pinhole cameras or fake keypad overlays that record PIN entry.
- Tampered terminals inside small retail locations, sometimes installed by a compromised technician.
Online capture
- Phishing pages that clone a bank login and prompt for a PIN as a security check. Real banks do not ask for that.
- Malicious scripts injected into checkout pages that exfiltrate form fields.
- Merchant database breaches where card numbers and CVVs sat in storage they should never have been in.
Why these bundles stop working quickly
A stolen CVV and PIN pair has a short shelf life, and that is by design. EMV chip transactions generate a unique cryptogram per tap, so a copied stripe plus a PIN does not reproduce on a chip terminal. Tokenization replaces the card number with a placeholder that is useless outside the merchant that created it. Issuers run velocity and geolocation rules that flag a card used in two distant places within minutes. Banks also monitor for the pattern that usually follows a skim: a small test charge, then a large one.
The economics are just as unforgiving. Card issuers reissue compromised cards, chargebacks land on merchants, and the people trading this data frequently get scammed by each other. Forums that host these listings are monitored by law enforcement and by fraud teams, and the accounts behind them are often honeypots.
What cardholders should do
- Cover the keypad when you enter a PIN, at any terminal.
- Wiggle the card reader and the keypad housing before you use them. Loose hardware is a red flag.
- Prefer chip tap or a mobile wallet over swiping. The cryptogram is what protects you.
- Treat any email, text, or call that asks for your PIN as fraud, no exceptions.
- Set transaction alerts and review them. Report unfamiliar charges the same day.
- If a card is lost or your data is exposed, freeze the card rather than waiting to see what happens.
What merchants and checkout teams should do
- Never store CVV or PIN data. PCI rules forbid retaining the verification value after authorization.
- Use point to point encryption at the terminal so card data never touches your network in the clear.
- Keep terminals physically inspected and inventoried. Know who serviced them and when.
- Run content security policy and script monitoring on checkout pages to catch injected skimmers.
- Reconcile chargebacks against device IDs to spot a compromised lane.
- Train staff to recognize tampered hardware and unauthorized service visits.
Reporting and legal exposure
If you find a skimmed device or a listing offering card data, contact the financial institution on the card and file a report with the FBI Internet Crime Complaint Center. The US Secret Service also investigates payment card fraud and skimming operations. For a consumer, a report at IdentityTheft.gov creates a recovery plan and a paper trail. For someone considering the selling side, the exposure is a federal felony, and the people running these operations are usually the first to be identified because they leave a payment trail of their own.
The short version: CVV plus PIN is not a product. It is evidence.