Short answer
Selling CVV dumps is a federal crime in the United States. No license, course, or business registration makes it legal. A "CVV dump" is payment card data copied from a card, most often the magnetic stripe tracks. Selling that data is trafficking in access devices under 18 U.S.C. § 1029. This page covers what the term means, what the statute covers, and what merchants and cardholders do instead.
This guide does not explain how to obtain, price, or move stolen card data. That information supports fraud.
What a CVV dump is
The term covers three related items.
- Track data. Track 1 and Track 2 data encoded on a card's magnetic stripe. A full track holds the primary account number (PAN), expiration date, service code, and a discretionary verification value.
- CVV1 / CVC1. A three-digit value encoded in the magnetic stripe. It is checked when a card is swiped.
- CVV2 / CVC2. The three-digit code printed on the back of the card. It is checked in card-not-present transactions.
Markets that advertise dumps sell track data in bulk, sometimes with the cardholder name, billing ZIP code, and bank identification number (BIN). Price and volume claims on those markets are unverifiable.
What the law says
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Subsection (a)(3) makes it a crime to knowingly and with intent to defraud traffic in one or more access devices. A payment card and its account number qualify as access devices. Penalties in § 1029(c) include fines and prison terms of up to 10 or 15 years, depending on the subsection. Restitution and forfeiture can apply on top of the sentence.
Related charges include wire fraud under 18 U.S.C. § 1343, aggravated identity theft under 18 U.S.C. § 1028A, and conspiracy. State laws add separate counts.
Why sellers get caught
- Payout trails. Proceeds move through banks, processors, and crypto exchanges. Those firms file reports and answer subpoenas.
- Device records. IP addresses, device fingerprints, and account metadata are logged by the platforms used to talk and trade.
- Network scoring. Visa, Mastercard, American Express, and Discover run fraud models. Issuers see patterns at the BIN level, including card testing.
- Undercover work. Federal cases often start with a cooperating witness or a controlled buy.
Cardholder protections
Under the Fair Credit Billing Act, consumer liability for unauthorized credit card charges is capped at $50. Most issuers waive it. Report a lost card or a fraudulent charge to the issuer. In the US, file an identity theft report at IdentityTheft.gov and a complaint with the FBI Internet Crime Complaint Center.
What merchants should do
- PCI DSS prohibits storing sensitive authentication data, including full track data and CVV2, after authorization. Do not log it.
- Tokenize card numbers so the PAN is not kept in your systems.
- Run Address Verification Service (AVS) and CVV checks on card-not-present orders.
- Apply 3-D Secure for higher-risk transactions.
- Watch for card testing: many small authorizations, sequential BINs, and mismatched geolocation.
FAQ
Is selling CVV dumps legal anywhere?
No US jurisdiction permits it. Other countries have comparable computer fraud and payment card statutes.
Does buying a dump carry the same penalty as selling?
§ 1029 covers trafficking, which includes transfer, sale, and receipt with intent to defraud. Charges depend on the facts and the US Sentencing Guidelines.