There is no legal way to sell CVV or CVC numbers, so the top recommendation for anyone typing "I want to sell CVV" is to stop and work out which lawful goal sits behind the search. The four paths below cover the realistic cases: a merchant who wants to accept cards, a business that wants to keep card data on file for subscriptions, a person who got a solicitation to sell card data, and a cardholder who wants to protect an account. The criteria I used are legality, alignment with PCI DSS, personal risk, and whether the path solves the real problem.
Why selling CVV data is not a business
The CVV or CVC is the three digit code printed on the back of most cards, and the four digit code on the front of American Express cards. It exists to prove that the physical card was present or that the cardholder had access to it. Card networks and the PCI Security Standards Council classify that code as sensitive authentication data, which merchants may not store after a transaction is authorized.
Offering that data for sale in the United States falls under 18 U.S.C. 1029, which covers trafficking in unauthorized access devices. Buyers and sellers both face federal charges, and payment platforms, hosting providers, and registrars close accounts tied to the trade once it is flagged.
Selling CVV 2024: What You Need to Know
- Pros: none that survive a processor review, a chargeback investigation, or a subpoena.
- Cons: criminal liability, frozen accounts, permanent bans from card networks, and civil claims from cardholders and issuers.
Use case: there is no legitimate one. If you found this page while shopping for card data, the real price is much higher than whatever number is listed.
Path 1: You want to accept card payments on a website
This is the goal behind most searches that use card-data language. The lawful route is a PCI DSS validated payment processor or gateway that hosts the checkout form and handles the card fields on its own infrastructure.
Pros
- Card data never touches your server, which cuts your compliance scope to the self assessment questionnaire for merchants who do not store card data.
- Setup is fast, and hosted checkout pages cover the tokenization, encryption, and fraud screening for you.
- Chargeback tools and address verification are included.
Cons
- Per-transaction fees reduce margin on low-ticket items.
- You give up control of the checkout look and feel unless you use a developer kit.
- Underwriting can take days for high-risk categories.
Use case: new stores, digital products, and anyone who wants card acceptance without building a compliance program.
Path 2: You want to keep cards on file for subscriptions
The answer is network tokenization, not stored CVV data. A token replaces the card number with a value that only your processor can resolve, and the security code is never retained.
Pros
- Renewals and one-click checkout keep working.
- A breach of your database exposes tokens that are useless outside your account.
- Storage rules under PCI DSS stay manageable because sensitive authentication data is out of scope.
Cons
- Token portability between processors can be limited.
- You depend on the provider for uptime and for key rotation.
Use case: subscription boxes, SaaS billing, and any merchant that needs repeat charges.
Path 3: Someone asked you to sell card data
Recruiters work through chat apps and freelance marketplaces, and they usually ask for a small test batch first. Do not send anything. Save the messages, the handles, and any wallet addresses, then file a report with the FBI Internet Crime Complaint Center and the Federal Trade Commission. Banks and card issuers also want the details, because they can block the accounts involved.
- Pros of reporting: it protects the cardholders, and it creates a record if the same party contacts you again.
- Cons: reporting takes time and you may be asked follow-up questions.
Path 4: You want to protect your own card
Freeze the card in your banking app, review recent transactions, and set alerts for card-not-present charges. Never read the security code aloud to an inbound caller, and never type it into a page reached from a text message. Banks do not ask for the code to verify a purchase they initiated.
How to choose
If money needs to move into your account, pick a processor and let it handle the card fields. If you need repeat billing, ask that processor about tokenization. If someone wants to buy card codes from you, report it. The only search result worth acting on is the one that leads to a compliant payment stack.