Short answer
There is no legal way to sell CVV or CVC data on a carding site. In the United States, buying, selling, or transferring payment card data without the cardholder's consent is access device fraud under 18 U.S.C. § 1029. A first offense involving more than $1,000 in access devices carries up to 10 years in prison. Larger and repeated cases go higher. Carding sites are criminal marketplaces. Law enforcement monitors them, and sellers get prosecuted.
How to Get Paid Selling CVV on Carding Sites: A Comprehensive Guide
What the words mean
The CVV (Visa) or CVC (Mastercard) is the 3-digit code printed on the back of a card. American Express prints a 4-digit CID on the front. The code exists to prove the person entering the number holds the physical card. A carding site is an online forum or shop where stolen card numbers, CVVs, and cardholder names change hands. A fullz bundle adds identity details such as address, date of birth, and Social Security number.
selling cvv dumps via carding forums
What the law says
18 U.S.C. § 1029 covers access device fraud. Subsection (a)(3) covers trafficking in access devices, which reaches sellers and buyers. Penalties in subsection (c) run from 10 to 15 years, set by the number and value of the devices. 18 U.S.C. § 1028A adds a mandatory 2-year consecutive sentence when the scheme uses another person's identity. The Department of Justice runs Operation Boiling Point, a coordinated effort against carding, skimming, and resale networks. Federal prosecutions have produced prison terms and restitution orders against forum operators, sellers, and buyers.
How card data leaves a cardholder's hands
- Skimming hardware on fuel pumps, ATMs, and point-of-sale terminals.
- Breaches at merchants and processors that keep data they should not store.
- Phishing pages and fake checkout forms.
- Malicious scripts injected into ecommerce checkout pages.
- BIN attacks, where bots guess card numbers in bulk against weak checkout pages.
Why the trade is a losing position for sellers
Carding markets operate outside contract law. Sellers face nonpayment, exit scams, and doxxing by other members. Forum databases get breached and resold. Law enforcement buys access and runs undercover accounts. A seller who takes payment in cryptocurrency leaves a public ledger that outlives the forum. The median price for a stolen card is a few dollars against a felony record and federal prison time.
selling cvv dumps via carding forums
What blocks the trade
PCI DSS Requirement 3 forbids storing the CVV or CVC after a transaction is authorized. That rule removes most of the supply. Card networks add 3-D Secure, which asks the issuer to verify the cardholder at checkout. Tokenization replaces the card number with a value that works at one merchant. Address verification and velocity checks flag a card used in many places in a short window. Chip and contactless cards stop counterfeit cloning at terminals.
If your card data is exposed
Freeze the card through the issuer's app or phone line. Order a replacement with a new number. Review statements for small test charges. File a report with the FTC at IdentityTheft.gov and a complaint with the FBI's Internet Crime Complaint Center. Dispute charges in writing within 60 days of the statement date under the Fair Credit Billing Act.