Short answer
No. Selling CVV dumps is a federal felony in the United States. It carries prison time, restitution, and asset forfeiture. The data decays fast, card issuers monitor it, and law enforcement runs operations against the people who trade it. This page covers the law and the detection systems. It does not explain how to sell card data.
What the term covers
"CVV dumps" is trade slang for card records that contain a card number and the verification value printed on the card. The data has to come from somewhere: a skimmer, a breach, or a phishing page. Each of those sources is a separate crime. Possession of the data is also a crime when intent to defraud is present.
Where to Sell CVV Dumps: There Is No Legitimate Marketplace
Legal exposure
- 18 U.S.C. § 1029 covers access device fraud. Trafficking in card data carries up to 10 years in federal prison for a first offense.
- Cases that involve 15 or more devices carry up to 15 years under the same statute.
- 18 U.S.C. § 1028A adds a 2-year sentence that runs after the main term when identity theft is involved. There is no probation on that count.
- Restitution is mandatory for fraud offenses under 18 U.S.C. § 3663A. Courts order the loss amount, not the seller's cut.
- Proceeds are subject to forfeiture. Investigators seize accounts, hardware, and crypto balances.
The same counts apply to buyers. A person who purchases card data and never uses it still faces access device charges.
Selling CVV Dumps on the Dark Web: A Card Security Guide
Why the trade does not pay
Data ages out
Card numbers have a short working life. Issuers reissue after a breach report, a fraud report, or a chargeback. A number bought this week can decline next week. Sellers carry the loss when the buyer disputes.
Issuers score every authorization
Card issuers run risk models on each transaction. Velocity, geography, device, and merchant type all feed the score. A card that worked once can be blocked on the next attempt. Issuers also place alerts on accounts tied to known breach ranges.
Networks watch merchants and volumes
Visa and Mastercard run fraud monitoring programs. Merchants with high chargeback ratios face fines, reserve requirements, or loss of card acceptance. That pushes fraud attempts toward processors that screen hard.
Tokenization removes the number
Network tokens replace the card number for stored credentials. A copied number fails where a token is required. EMV 3-D Secure authentication moves liability to the issuer and blocks many card-not-present attempts before settlement.
Enforcement is active
Europol coordinated an operation against Genesis Market in April 2023. Authorities in 17 countries made 119 arrests and seized the platform's infrastructure. The U.S. Department of Justice brings access device cases every year and publishes the sentences. Typical outcomes include prison terms, supervised release, and five-figure or six-figure restitution orders.
What to do instead
If you find card data offered for sale, report it. In the U.S., file a report with the FBI's Internet Crime Complaint Center. If your own card data was exposed, request a new number from the issuer and review statements for small test charges. Merchants should enable 3-D Secure, store tokens instead of numbers, and track chargeback ratios before a network program triggers.