The short answer
There is no legal way to sell CVV dumps on the dark web. In the US, trafficking in stolen card data is a federal felony. The statutes that apply include 18 U.S.C. § 1029 (access device fraud), 18 U.S.C. § 1028 (identity fraud) and 18 U.S.C. § 1343 (wire fraud). Convictions carry prison terms, restitution and forfeiture of proceeds. This page covers what the term means, why the market exists and how card-not-present fraud gets caught. It contains no selling instructions.
What a CVV dump is
A dump is data copied from a card magnetic stripe or EMV chip, read as track data. It holds the primary account number, the expiry date, the service code and a card verification value. That track value differs from the CVV2 or CVC2 printed on the back of the card, which online merchants request at checkout.
Two other terms appear in the same trade. A "fullz" record adds name, address, date of birth or Social Security number to card data. A BIN is the first six to eight digits of the account number, and it identifies the issuing bank. Bulk listings get counted in records, not in cards.
Why the market exists
Card-not-present fraud needs no physical card. A merchant that skips CVV2 checks and address verification accepts a purchase with only typed data. Breach data, skimmers on fuel pumps and point-of-sale malware feed the supply side. Payment Card Industry rules constrain the demand side: PCI DSS requirement 3.2 prohibits storing the CVV2 after authorization, so stolen track data has to be used before the issuer reissues the card.
Issuers reissue in volume after a breach. That shortens the useful life of a stolen record and pushes sellers toward rapid resale. Bulk records change hands for small sums because the failure rate per record is high.
Legal exposure in brief
- 18 U.S.C. § 1029 covers producing, selling, transferring or possessing counterfeit and unauthorized access devices. Statutory maximums run to 10 years per count for most conduct, with higher maximums for aggravated offenses.
- 18 U.S.C. § 1028 covers identity documents and authentication features, with maximums up to 15 years.
- 18 U.S.C. § 1343 covers wire fraud, with a maximum of 20 years, or 30 years when a financial institution is affected.
- 18 U.S.C. § 1956 covers laundering of proceeds, which applies when funds move through bank accounts, crypto exchanges or payment intermediaries.
- State statutes add separate card fraud and computer crime charges. Most states treat each card or each transaction as a separate count.
Sentencing runs on the federal guidelines. Loss amount, number of victims and use of a computer drive the range.
Why "how to" material on this topic is an unreliable source
Fraud forums carry scam risk in both directions. Buyers send payment and receive stale or invented records. Sellers deliver data and receive nothing. Escrow services on those forums are run by the same operators, and exit scams are common. Law enforcement runs covert accounts on the same platforms, and complaints and takedowns follow. A guide that promises working methods has a commercial motive behind it.
How card-not-present fraud gets detected
Issuers and fraud engines score each authorization. Signals include a CVV2 mismatch, an address verification mismatch, a new device on an established account, several cards tried against one session, and shipping addresses that differ from billing records. Velocity rules flag repeat attempts from one IP range. BIN attacks, where a script tests many account numbers against a small merchant, show up as a spike in declined authorizations.
3-D Secure adds an issuer-side authentication step. Strong Customer Authentication in the EU and UK produces a similar effect. Tokenization replaces the account number with a network token, so a stolen number has no use at a tokenized merchant.
What merchants should check
- Require the CVV2 on every card-not-present authorization and decline on mismatch.
- Run address verification and set a rule for partial matches.
- Turn on 3-D Secure for high-risk segments and cross-border orders.
- Tokenize stored credentials and never retain the CVV2 after authorization.
- Rate-limit authorization attempts per session, per card and per IP.
- Review declined-authorization spikes as a possible BIN attack.
What cardholders should do
- Turn on transaction alerts for card-not-present charges.
- Use virtual card numbers at merchants that support them.
- Freeze the card from the issuer app when a charge looks wrong, then dispute it in writing.
- Report identity theft to the Federal Trade Commission and file a complaint with the FBI Internet Crime Complaint Center.
If someone offers you stolen card data
Do not buy, do not resell and do not hold the files. Report the contact to the FBI Internet Crime Complaint Center and to the card issuer fraud line. Card networks pay bounties for some breach information, and issuers route reports to their fraud teams.