Short answer
You cannot sell CVV dumps. In the United States, offering stolen card numbers, card verification values, or magnetic stripe data for sale is a federal offense under 18 U.S.C. 1029, and a first conviction can carry up to 10 years in prison, with 15 to 20 years for trafficking in bulk. Canada, the United Kingdom, Australia, and the European Union have comparable statutes with similar prison terms and asset forfeiture. The criminal exposure is only half of the problem. Most people who claim to buy CVV dumps on forums, Telegram channels, and dark web shops are running advance-fee scams aimed at the seller.
The sections below explain what the term actually describes, why the underground market fails for almost everyone who touches it, and how cardholders and merchants cut off the theft that supplies it.
What "CVV dumps" means
A card verification value is the three-digit code on the back of a Visa, Mastercard, or Discover card, or the four-digit code on the front of an American Express card. It exists to prove the person paying has the physical card in hand. A "dump" in criminal slang is the data pulled from a card's magnetic stripe, which includes the account number, expiration date, and service code. Sellers who advertise "CVV dumps" are usually mixing terms to sound credible. What they claim to hold is a bundle of stolen card records, sometimes with the cardholder's name, billing address, and phone number attached, a package criminals call fullz.
None of that data is theirs to sell. It comes from skimmers on gas pumps and ATMs, breached merchant databases, phishing pages, and malware on checkout systems.
Why the underground market fails for the seller
Escrow services in these markets are run by the same groups selling the data, so a seller who hands over a batch of records has no enforceable claim when payment never arrives. Card networks and banks also cancel stolen accounts quickly, which means the inventory goes stale within days and buyers demand refunds. Chargeback disputes inside criminal markets turn into extortion. There is no court, no contract, and no police report a participant can file without incriminating themselves.
Legal exposure in practice
US prosecutors charge trafficking in unauthorized access devices, wire fraud, identity theft, and conspiracy in the same indictment. Sentences stack. Restitution orders follow a defendant for years after release, and seized devices, crypto wallets, and bank accounts are forfeited. Payment processors and banks also report suspicious card-data activity to the FBI's Internet Crime Complaint Center, which builds patterns across cases rather than treating each one alone.
Steps to keep your own card data out of those lists
- Freeze your credit at all three US bureaus so nobody can open new accounts with your identity.
- Turn on real-time transaction alerts in your bank app and read each one.
- Use virtual card numbers for online subscriptions and unfamiliar merchants.
- Pay with a credit card rather than a debit card, since credit limits your liability to unauthorized charges.
- Wiggle the card reader and the keypad before you pay at a pump or an ATM, and look for loose panels or extra hardware.
- Review your statements every week rather than once a month.
Steps merchants take to stop stolen card use
- Discard the CVV immediately after authorization instead of writing it to a database.
- Replace stored card numbers with network tokens so a breach yields nothing usable.
- Require address verification and CVV checks on every card-not-present order.
- Apply 3D Secure or a similar step-up challenge on high-risk transactions.
- Watch for velocity spikes, mismatched shipping addresses, and repeat declines from one device.
If your card data appears for sale
- Call the issuer and ask for the card to be closed and reissued with a new number.
- Dispute every charge you did not make, in writing, within the window your issuer allows.
- Place a fraud alert or a freeze with the credit bureaus.
- Change the password on any shopping account that stored the card, and turn on two-factor authentication.
- File a report at IdentityTheft.gov and with your local police if the issuer asks for one.
Reporting a seller
Send what you have to the FBI's Internet Crime Complaint Center and to the card issuer's fraud line. Include screenshots, handles, wallet addresses, and dates. You do not need to buy anything to file. Investigators use these reports to link accounts across cases, and the report costs you nothing.