You cannot legally sell CVVs in the United States, and there is no working market where you can. Trafficking in card verification values falls under 18 U.S.C. § 1029, which covers the sale and transfer of unauthorized access devices. Beyond the law, the practical answer is worse: the sites, chat rooms, and "vendors" that show up when someone searches for this are built to take money from the people trying to sell, not to pay them.
Want to Sell CVV Data: It Is a Federal Crime in the US
What a CVV actually is
A card verification value is a three or four digit code printed on a card and used to prove that the person entering the number physically has it. Merchants pass it to the payment network during authorization and are not allowed to store it afterward. That is the whole design. The code has no value on its own. It only means something next to a card number, an expiration date, and a cardholder who authorized the charge.
Why sellers get burned more than buyers
The people shopping this kind of search are usually not professional fraudsters. They are people who found a chunk of card data, or who think they have, and are looking for a payout. That is exactly the profile the scams are built for.
- Upfront "escrow" or "activation" fees that vanish with the person collecting them.
- Buyers who ask for a sample first, then block you once they have it.
- Fake marketplaces that require your own ID, bank details, or card to "verify" you.
- Chat groups that quietly log IP addresses and device fingerprints for later extortion.
I look at these setups the same way I look at any advance-fee scam. The money only ever moves in one direction.
The legal math
Trafficking offenses under § 1029 carry prison terms that reach 15 years, with higher exposure when the conduct is aggravated. Prosecutors do not need a completed sale to bring charges. Possession with intent to defraud, and attempted transfer, are enough. Wire fraud and identity theft charges often stack on top. When banks trace a stolen card back through a Cash App, a crypto wallet, or a shipping address, the trail usually ends at a name, and it is not the buyer's.
Who absorbs the damage
Cardholders spend weeks disputing charges and replacing cards. Small merchants eat chargeback fees and lose the ability to accept certain payment methods. Issuers raise rates across their whole customer base to cover losses. It is not a victimless trade, and it is not a clever shortcut around a job.
If your real interest is payment security
The skills people imagine they need for this are the same ones legitimate employers pay for:
- Fraud analyst roles at banks and processors, where you build rules that catch stolen cards in real time.
- PCI DSS assessment and compliance work, which is steady, credentialed, and remote-friendly.
- Bug bounty programs, including ones run by fintech companies that pay for checkout and tokenization flaws.
- Application security engineering focused on payment flows and card data handling.
Those paths pay in dollars and do not come with a criminal record attached.
Protecting your own card
Use virtual card numbers for subscriptions. Turn on transaction alerts. Never read a CVV aloud on a call you did not initiate. Check your statements weekly rather than monthly, because the faster you flag a charge, the less cleanup follows.
The bottom line: selling CVVs is a felony with a scam layered on top of it, and the odds are stacked against the seller. If you want income from knowing how card data moves, the legitimate side of that knowledge is hiring right now.