If you are searching for how to sell CVV through shop listings, stop: there is no legal version. Selling card verification values that belong to someone else is access device fraud and wire fraud. The shop name, the platform, or the payment method does not change the crime.
What Does It Mean to Sell CVV Through a Shop?
A carding shop is a website or app catalog where stolen payment card details go on sale. The listing shows the card number, expiry date, and the CVV2 or CVC2 code. Buyers use that code to pass the security check at online checkout.
These shops sort the records into combos, dumps, or fullz. Those terms only describe how much data got stolen. None of them describe a legal seller.
Typical CVV listings contain:
- Primary Account Number (PAN) and expiration date
- CVV2 or CVC2 security code
- Cardholder name and billing ZIP
- Fullz adds date of birth and Social Security number
Is It Ever Legal to Sell CVV Codes to a Shop?
No. There is no retail or wholesale market where banks buy back CVV codes. A CVV exists only to verify that the physical card is present. Once that code leaves the card, it becomes stolen data.
Merchants can verify a CVV during an order through their payment gateway. That request happens in real time against the card issuer's systems. The merchant never owns a CVV database that can be resold.
Which Federal Laws Make Selling CVV Data a Crime?
The main statute is 18 U.S.C. § 1029, the access device fraud law. Congress wrote it to stop the trade in card numbers, account codes, and payment credentials. Selling any of those without the issuer's permission breaks the law.
Prosecutors add the wire fraud statute, 18 U.S.C. § 1343, when a shop or messaging app carries the transaction. Sellers use interstate wire communications to run the scheme. That is the second charge in most federal cases.
State laws stack on top. California, Texas, New York, and Florida have their own computer fraud and identity theft statutes.
Federal laws at a glance:
- 18 U.S.C. § 1029: up to 20 years for trafficking or possessing access devices
- 18 U.S.C. § 1343: up to 20 years per wire fraud count
- 18 U.S.C. § 1028A: mandatory two-year addition for aggravated identity theft
What Penalties Do CVV Sellers Face?
The sentence scales with the number of cards and the dollar loss. Even a single CVV sale can bring a multi-year felony charge. Judges look at how long the shop ran and how much it earned.
Real penalties from federal cases include:
- Up to 10 years for a first offense under § 1029
- Up to 20 years when the case involves 15 or more devices
- Up to 20 years for each wire fraud count
- Fines up to $250,000 per offense
- Restitution to banks and cardholders
Anyone who sells fullz with a name and Social Security number also faces 18 U.S.C. § 1028A. That charge adds a mandatory two-year prison term. Card brands can also file separate civil suits to recover losses.
How Do Undercover Agents Find Sellers on a CVV Shop?
The FBI and Secret Service monitor carding shops. Agents pose as buyers to test the site and collect seller details. One undercover purchase is enough to build a case.
Those operations capture more than the payment. Investigators log incoming IP addresses, crypto wallets, and chat messages.
Shops that claim to wipe logs still keep order databases. The seller's pattern, not the platform, becomes the fingerprint.
Does the Minimum Amount Sold Matter?
No. The crime starts at the first card number. Federal law also charges conspiracies and attempts, so a plan to sell can lead to an arrest before a sale happens.
Prosecutors do not need to prove a buyer received the data. They need evidence that the seller intended to traffic access devices.
What if the CVV Data Comes From Your Own Business?
Small business owners sometimes collect card data from customers and think they can resell it. Your processing agreement with Visa, Mastercard, or the processor forbids storing or selling CVVs.
If you export card numbers from your own store, you are no longer acting as a merchant. PCI DSS rules also require you to erase CVV data after the transaction. Selling that data violates both the card network rules and federal law.
What Should You Do When You See a CVV Shop?
Do not buy, do not message the seller, and do not test a card. Leave the page and close the tab.
Then follow these steps:
- Report the site to the FBI Internet Crime Complaint Center.
- File a complaint with the Federal Trade Commission.
- If you already paid, call your bank and dispute the charge.
- Place a fraud alert with one of the three credit bureaus.
- Change the passwords for every account linked to that payment method.
Raising a report takes less time than explaining a theft charge to an employer.
What Are the Legal Ways to Get a CVV Code?
The only legal source for a CVV is the bank that issued your card. Look at the physical card, or open the issuer's secure mobile app. Some issuers offer a one-time CVV for online shopping.
Merchants do not buy CVV lists. Their payment processor checks the code against the issuer during authorization. The merchant only sees a pass or fail response.
This design keeps CVV data with the cardholder and the bank. No legitimate market exists in between.
Frequently Asked Questions
Can I sell CVV from my own credit card?
No. Selling your own CVV hands your security code to a stranger. It also puts you inside an illegal payment scheme, even if the card is yours.
What is the difference between a CVV and a PIN?
The CVV is printed on the card and used for online orders. The PIN is a secret number you type at an ATM or checkout terminal. Both are access devices under section 1029.
Is it legal to sell old or expired CVV numbers?
No. An expired card number is still an access device. Prosecutors can charge possession with intent to defraud even when the card has no working balance.
Can a VPN make a CVV shop anonymous?
A VPN hides an IP address for a while, but it does not erase the rest of the trail. Bitcoin movements, email accounts, and shared logins all link back to the seller. Federal cases have been built on those traces.
What happens if I only sell CVVs on Instagram or Telegram?
Federal agents monitor those spaces. Social media platforms hand over account records after a search warrant. The seller's phone often contains the same shop logs.
The Bottom Line
A search for sell CVV through shop will not find a trustworthy vendor. It will find risky markets and undercover agents. The only safe financial decision is to stop before any card data changes hands.