There is no legal way to sell CVV dumps. A CVV dump is stolen payment card data, and offering it for sale is a federal crime in the United States under 18 U.S.C. § 1029, with prison terms that reach 10 years for a first offense and 15 to 20 years for aggravated cases. Anyone hunting for a market in card data is hunting for a crime scene, not a business.
This guide covers what a dump actually contains, the statutes that apply, how banks and card networks catch stolen card data in use, and what to do if your own card shows up for sale.
What Is a CVV Dump?
A CVV dump is a copied record of payment card data taken from a card or a merchant database. In carding slang, "dump" first meant the magnetic stripe track data that a skimmer captures at a fuel pump or ATM. A full dump can hold the primary account number, expiration date, cardholder name, service code, and card verification value.
Sell CVV Dumps Bitcoin: What Those Listings Really Are and How to Protect Your Card
The term is fuzzy in practice. Some sellers use "dump" for any card number plus CVV pair. Stolen is stolen either way, and the label changes nothing about the legal exposure.
Why Selling CVV Dumps Is a Federal Crime
US law classifies card data as an "access device." Selling, transferring, or holding one with intent to defraud is a crime under 18 U.S.C. § 1029. There is no licensed market, no broker permit, and no lawful path to move the data for money.
Four statutes cover the same conduct, and they stack:
- 18 U.S.C. § 1029: fraud and trafficking in access devices, up to 10 years for a first offense.
- 18 U.S.C. § 1028: identity theft, added when the data belongs to a real person.
- 18 U.S.C. § 1343: wire fraud, added for any sale arranged over the internet.
- State law: most states carry their own felony charges for card trafficking and identity theft.
Charges build per record. Prosecutors can treat each card in a file as a separate count, so a file of 500 records can support 500 counts. Restitution orders land on top of prison time and can follow a defendant for decades.
What Happens to People Who Try to Sell Card Data?
Carding forums are watched. The FBI, the Secret Service, and postal inspectors keep undercover accounts on the same boards where dumps trade, and card networks pass transaction data to investigators.
Buyers on those boards are often scammers themselves. Exit scams are routine: the buyer takes the file, blocks the seller, and vanishes. The seller cannot call the police, because the thing that got stolen was stolen.
A conviction means prison, a restitution order, and a record that closes off bank accounts, payment processing, and most jobs in finance.
Can a "CVV Shop" Operate as a Legal Business?
No. Selling card data breaks card network rules, so no bank will underwrite a merchant account for it. Acquirers and networks require a real product, know-your-customer checks, and chargeback liability before they approve anyone.
That is why dump sites run on bulletproof hosting and take crypto. Both choices raise risk for the operator: hosting firms keep server logs, and blockchain analysis firms map wallet flows for investigators.
How Banks Catch Stolen Card Data in Use
Issuers score every authorization in milliseconds and decline the odd ones. A few checks do most of the work:
- CVV and AVS checks: a mismatch between the billing address or verification value flags the transaction.
- Velocity and geo rules: a card used in three states in one hour gets blocked.
- Tokenization: Apple Pay and similar wallets swap the card number for a token, so a stolen dump carries no usable value.
- EMV chips: chip transactions generate a one-time cryptogram that a copied magstripe cannot reproduce.
- Machine learning scoring: device fingerprints and purchase patterns feed a fraud model on each order.
Merchants add their own layer with 3-D Secure step-up and address verification. Validity rates for dumps keep falling for this reason. Any seller promising "100% live" cards is running a scam or working with law enforcement.
How to Protect Your Cards From Dumps
The same defenses that block card-not-present fraud also limit the damage if your data leaks.
- Use the chip or tap to pay. Never let a clerk swipe the stripe.
- Turn on transaction alerts in your banking app.
- Use virtual card numbers at merchants you do not know.
- Freeze your card in the app when you are not using it.
- Check statements weekly, not monthly. Small test charges come first.
If Your Card Data Ends Up for Sale
Call the number on the back of your card and ask for a new account number, since replacing the plastic leaves the old number live. A freeze stops new charges while the issuer investigates. Then dispute the charges in writing and file a report at IdentityTheft.gov, which builds a recovery plan and an official record.
FAQ
Is selling CVV dumps a felony?
Yes. In the US it is a federal felony under 18 U.S.C. § 1029, and most states add their own felony charges for card trafficking and identity theft. A first federal offense carries up to 10 years in prison.
Can you get caught selling dumps?
Yes. Undercover agents buy on carding forums, hosting providers hand over logs, and crypto exchanges file suspicious activity reports. Most arrests trace back to one cooperating witness or one seized server.
What does "CVV dump" mean in security terms?
It means stolen card data. Fraud teams file it under compromised credentials or card-not-present fraud records. The payments industry tracks it as a loss event, not a product category.
Why do dump sellers demand crypto?
Because no regulated payment processor will touch the sale. Crypto also turns the seller into a target for theft and leaves a public ledger that investigators can follow with chain analysis tools.