No. There is no legitimate market for selling CVV or CVC data online. A card's three or four digit security code exists to prove the physical card is present, and selling, buying, or trading that code is access device fraud under US federal law. Every site, Telegram channel, or forum that advertises "legit CVV shops" with live cards is either a criminal operation, a scam that takes the seller's money, or a law enforcement honeypot.
Why do so many sites claim to sell CVV data "legitimately"?
The word "legit" is marketing. Carding markets use it to signal that the cards are freshly skimmed and not already blocked, not that the transaction is lawful. Any platform hosting these listings is built to move stolen account data, and payment for it moves through crypto or gift cards to avoid traceable banking rails.
What does US law say about selling card security codes?
Under 18 U.S.C. Section 1029, trafficking in access devices covers selling, transferring, or possessing card account numbers and security codes with intent to defraud. Convictions carry up to 10 to 15 years for a first offense plus fines, and aggravated cases involving large volumes go higher.
- Offering card data for sale is trafficking, even if no card is ever charged.
- Possessing a stack of codes outside authorized business use is evidence of intent.
- Conspiracy charges apply to anyone who helps route the payment or hosts the storefront.
How do these offers usually end for the person selling?
Most people who try to sell card data are the target, not the merchant. Common outcomes include escrow accounts that vanish with the deposit, "verification fees" that grow with each step, and buyers who demand a free sample batch of real codes before ghosting.
Signals that a CVV offer is a scam aimed at you
- The buyer asks you to send card images or codes before any payment clears.
- A middleman requires a deposit to "activate" escrow or a vendor account.
- The platform only accepts gift card codes, which are irreversible once shared.
- You are asked to install software or run a command to "test" your card data.
Is there any lawful way to work with real card data?
Yes, but only inside audited business channels. Authorized merchants and processors handle card numbers under PCI DSS rules and never store the CVV after authorization. Security researchers test with their own cards or with synthetic test numbers issued by a payment processor, never with codes taken from other people's accounts.
How do you keep your own CVV from being sold?
Treat the security code like cash and never type it into a message, email, or chat. Cover the back of the card, shop only on sites that redirect to a verified checkout, and use virtual card numbers for unfamiliar merchants.
- Never read your code aloud on a call you did not initiate.
- Do not store card photos in cloud galleries or texting apps.
- Review statements weekly and dispute unknown charges the same day.
- Freeze the account in your card issuer's app if the card is missing.
What should you do if someone offers to buy your card data?
Decline, screenshot the offer, and report it to the FBI's Internet Crime Complaint Center and the FTC. Then call the number on the back of your card and ask for a replacement with a new security code. Reporting also helps payment processors shut down the storefronts that host these listings.
Does a valid CVV prove a site is safe?
No. A checkout that accepts a CVV only confirms the code matches on file. Site safety depends on TLS, tokenization, and whether the merchant is PCI validated.
Can I sell unused gift cards or card points instead?
Reselling gift card balances is legal in most US states, and selling rewards points is governed by each program's terms. Neither involves disclosing a card security code to a stranger.