Short answer
There is no legal way to sell CVV numbers. A CVV or CVC is a card verification value that exists to prove the person paying is holding the physical card, and trading those codes outside the card networks is payment card fraud under U.S. federal law and every state's criminal code. People searching how to sell CVV now usually fall into three groups: someone who has been offered stolen card data, a merchant worried about chargebacks, or a reader who wants to understand the topic. This guide answers that search by explaining what a CVV is, why selling one is a crime, and how card data is protected instead.
What a CVV actually is
A CVV is a short numeric code printed on a card or generated for a digital wallet. It is not a password and it is not a product. Its only job is verification at the moment of purchase.
- CVV2 / CVC2: the three digits on the back of most Visa, Mastercard, and Discover cards.
- CID: the four digits on the front of American Express cards.
- Dynamic CVV: a rotating code some issuers generate for online use.
Because the code is meant to be seen only by the cardholder, any market where CVV codes change hands is a market in stolen credentials.
How to Sell CVV Instantly Online
Why selling CVV data is a crime
Selling card verification values is treated as access device fraud and identity theft. The codes themselves are not yours to trade unless you are the cardholder, and even then you cannot sell access to your own account as a business. Buyers who use the codes to make purchases commit unauthorized transactions, and sellers are typically charged as part of the same scheme.
The practical consequences are severe: frozen bank accounts, civil liability for the full value of fraudulent charges, and criminal exposure. There is also no consumer protection for anyone who buys stolen card data, so a buyer who is scammed by a seller has no recourse and cannot report the loss without admitting to a crime.
How stolen card data circulates
Card data leaves a cardholder's control in a few common ways. Recognizing them helps merchants and shoppers spot exposure early.
- Skimming: hardware or software attached to a payment terminal or checkout page.
- Phishing: messages that imitate a bank, retailer, or delivery service and ask for card details.
- Data breaches: intrusion into a merchant's systems that exposes stored payment records.
- Malicious scripts: code injected into an online checkout that copies form fields as they are typed.
Once exposed, card numbers are bundled and resold across chat channels and underground forums. None of those channels are legal, and none of them offer any guarantee of a working code.
If someone offers to sell you CVVs
Do not engage, and do not send money. Offers to sell card data are a common setup for advance-fee scams, where the seller takes payment and disappears, or for malware delivery through attached files.
- Stop communicating with the seller and do not click any file or link they send.
- Save the message, username, and payment details as evidence.
- Report the contact to the FBI's Internet Crime Complaint Center and to the FTC.
- If a card of yours was used or exposed, call the issuer and request a replacement number.
If you run an online store
Merchants carry the real burden of CVV fraud through chargebacks, fines, and lost processor access. The controls that matter most are the ones that keep verification data out of your own systems.
- Never store the CVV, CID, or full magnetic stripe data after a transaction is authorized. PCI DSS prohibits retaining this sensitive authentication data.
- Use a payment processor's hosted fields or tokenization so card numbers never touch your servers.
- Turn on 3-D Secure or an equivalent step-up authentication for high-risk orders.
- Match the billing address and require the CVV on every card-not-present transaction.
- Segment your network, patch checkout software, and monitor for injected scripts on payment pages.
If your own card was compromised
Federal law limits your liability for unauthorized credit card charges, and most issuers go further by waiving it entirely when you report promptly. Contact the issuer as soon as you notice an unfamiliar charge, review statements for small test charges, and place a freeze or fraud alert with the credit bureaus if your personal data was also exposed.
FAQ
Is there any legitimate market for CVV numbers?
No. Card verification values are issued to cardholders for their own use. Any offer to buy or sell them is a fraud offer.
Can a merchant sell CVV data it collected?
No. Merchants may not retain CVV data after authorization, so there is nothing legitimate to sell.
What should I do if I typed my card details into a fake checkout page?
Call your issuer immediately, ask for a new card number, and dispute any charges you did not make.