You cannot legally sell CVV with PIN anywhere in the United States. Selling cardholder verification codes and personal identification numbers is card fraud, a felony under federal access device law. If you have another person's CVV and PIN, the only safe action is to report it, not to market it.
What does “sell CVV with PIN” mean?
In carding discussions, the phrase “sell CVV with PIN” refers to a package of stolen payment data. That package includes the full card number, expiration date, CVV, and the cardholder's ATM PIN.
Thieves call this a “full.” With a PIN attached to a CVV, the criminal can withdraw cash from an ATM or use the card at a checkout terminal that asks for a PIN. Without the PIN, the stolen number is mostly useful for online purchases, which is riskier for thieves because online checks are more visible.
Those “fulls” appear on telegram groups, dark web forums, and some social media pages. Federal agents routinely monitor those spaces, and many buyers are undercover officers.
Is selling your own card's CVV and PIN ever legal?
No. Even if the card belongs to you, sharing your CVV and PIN violates the card issuer's terms. Cardholder agreements require you to keep the PIN secret.
If you sell your own card and PIN, you lose protections against fraudulent charges. The buyer can drain the account, and the bank will hold you responsible because you authorized the release of the data.
Businesses face the same restriction. The Payment Card Industry Data Security Standard (PCI DSS) requires merchants to never store the CVV after a transaction. If you are a merchant, you are not allowed to collect and resell cardholder codes at any time.
What penalties do sellers of CVV with PIN face?
Federal penalties for access device fraud are serious. Under 18 U.S.C. §1029, a first offense of trafficking stolen card data can bring up to 10 years in prison, and a second offense can bring 20. Fines can reach $250,000 for an individual, and forfeiture of phones, computers, and cash is common.
State charges also apply. The cardholder may sue you in civil court, and banks will request restitution for every dollar taken. Many first-time carders receive multi-year sentences, not warnings.
- Federal prison time and supervised release
- Fines plus restitution to banks and cardholders
- Loss of your equipment through forfeiture
- Permanent record that blocks bank accounts and rental housing
It is also a myth that selling data for a small amount reduces your risk. Each card number sold is a separate count in an indictment. One sale of 100 cards can lead to 100 charges.
Who buys CVV and PIN data, and what do they do with it?
The person who buys CVV with PIN is breaking the law just as much as the seller. There is no legitimate reason for an individual or company to purchase a card number and its PIN from someone who is not the issuing bank.
A legal online store needs only the card number, expiration date, and CVV. It never needs the PIN. A legitimate ATM withdrawal uses the physical card and the PIN, which leaves no room for a third-party reseller.
Buyers use these bundles to create duplicate cards, empty bank accounts, or buy goods in person. They often ask sellers to “test” a code by checking the card balance first. That test leaves a digital trail for law enforcement.
What should you do if you already have stolen CVV data?
Stop. Do not run a test, do not contact buyers, and do not share the numbers with anyone.
- Write down the first six and last four digits of the card, enough for a bank to identify it.
- Contact the card issuer and explain that you have discovered a data breach or stolen card information.
- File a report with the Federal Trade Commission at IdentityTheft.gov.
- Delete the stolen card data from your phone or computer.
- Speak to a defense lawyer before making any statement if you bought or sold stolen data already.
Possession of stolen card details is not a “minor” thing. But acting quickly and cooperating with authorities is far better than trying to profit. The legal system is designed to punish the sale, not the person who identifies a problem.
How should a legitimate business handle a customer's CVV?
If you run a store, never write a customer's CVV on paper and never enter it into your own database. Your payment terminal or gateway captures the CVV and sends it to the bank for verification, then the system discards it.
You also do not need a customer's ATM PIN to process an online or in-store purchase. At a physical point-of-sale terminal, the PIN goes directly to the card network through encryption. Neither you nor your software has access to it.
If a customer offers to share their CVV or PIN through email or text, refuse. Storing that data puts you in violation of PCI DSS and can cancel your merchant account. Instead, ask them to pay through a secure checkout page or call the issuing bank for help.
What does your own card issuer legally allow you to do with a PIN?
The card issuer hands you the PIN as a secret authenticator. It lets you prove you are the physical cardholder when you use an ATM or payment terminal.
That PIN is tied to the account and to your identity. The bank never authorizes you to sell it. If you write the PIN on your card, carry it in your wallet, or store it in an unscrambled note on your phone, you are increasing your fraud risk, not breaking federal law.
When you see “sell cvv with pin” on a website, you are looking at a criminal offer. For a cardholder, the only legal sale that uses a CVV is the checkout order you place with the merchant, where the CVV is entered as verification and then discarded. Nothing about that transaction allows a seller to resell the code later.
Frequently asked questions
Can a bank sell a CVV with PIN to me?
A bank never sells your CVV or PIN to you; it prints or issues those numbers as part of the card account. The CVV on your card and the PIN you choose are both created by the issuer. There is no secondary market for them.
Is selling CVV with PIN legal if the cardholder signs a release form?
No. Card network rules and federal law do not recognize a “release” for stolen or shared card data. A signed form does not override the cardholder agreement or the criminal code.
What if I only sell one CVV as a test?
Selling one code is still a federal crime. Each card number counts as a separate offense, and prosecutors often combine charges across state lines to trigger longer sentences.
Can I use cards with CVV and PIN to test my own payment website?
Only if you use your own actual card and your own PIN. Testing a payment processor with someone else's data is not a security review; it is theft. Use a sandbox test card number supplied by your payment gateway.
No legitimate financial product, payment processor, or merchant agreement includes the phrase “sell cvv with pin.” The only healthy way to generate income with payment cards is to sell goods or services, not the card data itself.