Short answer
There is no legal way to learn to sell CVV dumps. A "dump" is card data copied from a magnetic stripe or a payment database. Selling that data is trafficking in unauthorized access devices under 18 U.S.C. § 1029, a US federal felony. The statutory maximum runs from 10 to 15 years in prison depending on the subsection, plus fines and restitution. This page explains the term, the law, and the defenses that protect card data.
Selling CVV Dumps on the Dark Web: Why It Is a Federal Crime
What a CVV dump is
A dump is a record of card data. On a magnetic stripe the data sits in Track 1 and Track 2. Track 2 holds the primary account number, the expiration date, and a service code. The CVV in a dump is CVV1, a value the card issuer computes from the account number and expiry and writes to the stripe. CVV1 is not the same as CVV2, the three digit code printed on the back of a card for online orders.
Buyers of dumps want the account number, the expiry, the cardholder name, and the CVV1 value. That set lets someone encode a counterfeit stripe. Online merchants never see CVV1, so a dump has no use in a normal web checkout.
- Track 1: cardholder name, account number, expiry, service code
- Track 2: account number, expiry, service code, discretionary data
- CVV1: issuer computed value on the stripe, not printed
- CVV2: three digits printed on the card, used for card not present orders
How the data leaves a card
Most dumps come from three sources. Skimmers are devices fitted to fuel pumps and ATMs that read the stripe. Breaches expose stored card data at merchants and processors. Phishing and malware on point of sale systems copy track data as it passes.
how to sell cvv dumps on dark web
Card networks and the PCI Security Standards Council publish rules that block these paths. PCI DSS forbids storage of the CVV2 value after authorization and forbids storage of full track data. Merchants that keep track data past authorization fail the audit and hold the loss when a breach happens.
Why the sale is illegal
The relevant US statutes:
- 18 U.S.C. § 1029 covers counterfeit access devices, trafficking in them, and possession of device making equipment.
- 18 U.S.C. § 1028A adds a mandatory two year term for aggravated identity theft tied to the fraud.
- 18 U.S.C. § 1343 covers wire fraud for the online sale itself.
Prosecutors charge sellers, not just users. A 2023 case in the Eastern District of Virginia charged operators of a carding marketplace with conspiracy under § 1029. Penalties included forfeiture of servers and crypto assets. Card fraud losses run in the billions of dollars per year, and payment networks fund fraud teams that trace marketplace traffic back to accounts.
The defensive side, which is legal to learn
Card security work pays and carries no legal risk. The core controls:
CVV and CVC checks
A card not present order should send the CVV2 to the issuer for verification. A decline on CVV means the buyer does not hold the card. Merchants should not store the CVV2 in any form, including logs and support tickets.
Address Verification Service
AVS compares the billing street number and ZIP code to issuer records. AVS plus CVV blocks most card testing runs.
Tokenization
Networks replace the account number with a token that works at one merchant or one device. A stolen token has no value outside that scope.
3-D Secure
3-D Secure adds an issuer step at checkout. The issuer authenticates the cardholder and returns a cryptogram for that transaction.
What to do if you meet a dump seller
Do not send funds. Do not test a card. Report the contact to the payment network's fraud line and to the FBI Internet Crime Complaint Center. In the US, the FTC takes identity theft reports at IdentityTheft.gov.
If your own card data may be exposed, ask the issuer for a replacement number and check statements for small test charges. Card testing often starts with charges under two dollars.