The direct answer
No amount of bitcoin makes selling a CVV code legal or safe. A CVV is a security feature that proves the person paying holds the physical card, and selling it is the core step in carding. There is no published price, no escrow, and no legitimate buyer. Any forum post, chat message, or vendor page that quotes a rate for CVV numbers is either a criminal marketplace or a scam that takes the seller's bitcoin or the buyer's money. In the United States, the transaction itself is a federal crime under 18 U.S.C. Section 1029, which covers trafficking in access devices.
What the three digits actually are
Visa calls it CVV2 and Mastercard calls it CVC2, while American Express prints a four digit code on the front. The code is not stored on the magnetic stripe or the chip. That is the entire point. It exists so a merchant can ask for something a thief who only has the card number does not have. PCI rules forbid merchants from keeping the code after authorization, which is why a properly built checkout asks for it on every order.
Why the question keeps showing up
- Search demand from carding forums that advertise card shops with tier pricing based on account balance, issuer country, and whether a full bundle of personal data is included.
- Scam operators that copy those listings to collect payment from people who cannot report the loss without admitting to a crime.
- Curiosity traffic from readers who hear about carding and search the phrase without knowing the legal exposure behind it.
What the law says
- 18 U.S.C. Section 1029: trafficking in or using unauthorized access devices, with penalties up to 15 years for aggravated cases.
- 18 U.S.C. Section 1028: identity theft when the card data belongs to a real person.
- 18 U.S.C. Section 1343: wire fraud for the bitcoin transfer itself, because the payment crosses state or national lines.
- Card network rules: chargebacks and fraud reports trace back to the account that received the funds, and exchanges answer subpoenas.
Before you start
- Your physical card, so you can read the last four digits and the issuer phone number.
- Access to your bank or card app.
- Your statements for the past 60 days.
Steps if someone asks you to sell or buy a CVV
- Stop the conversation. Do not send card data, do not send bitcoin, and do not confirm that you hold either.
- Save the messages, usernames, wallet addresses, and timestamps in one folder.
- Report the contact to the FBI Internet Crime Complaint Center or to your local police department.
- Report the marketplace or chat channel to the platform that hosted it.
- Call the number on the back of your card and ask for a block and a reissue if any of your own details were shared.
Keeping your own CVV out of these channels
- Enter the code only on a checkout page you reached by typing the merchant domain or by opening the merchant app.
- Confirm the padlock and the exact domain spelling before the payment form loads.
- Refuse any request to send the code by text, email, or chat, including a request that claims to be a fraud alert from your bank.
- Use a virtual card number from your issuer for subscriptions and unfamiliar sites so the real code stays private.
- Keep the card in a shielded wallet and cover the back when you hand it over in person.
If your card data was exposed
- Freeze the card in your bank app so no new authorizations clear.
- Request a new card number and a new CVC, not just a replacement card with the same digits.
- Pull your free credit reports and place a freeze or fraud alert with the bureaus.
- File an identity theft report if charges posted or new accounts were opened in your name.
- Dispute unauthorized charges in writing within the window your issuer sets.