There is no trusted place to sell CVV data
No legitimate venue for selling CVV data exists. Every marketplace, forum, chat channel, and self-styled vendor that advertises card verification values for sale is either a scam, an undercover operation, or a criminal group selling you other people's stolen data. In the United States, buying or selling that data falls under wire fraud, access device fraud, and state identity theft statutes, and the buyer is the one who eats the loss when the money is gone. The real buying decision is not which CVV market to trust. It is which payment security stack to purchase so the card verification code never becomes a commodity worth trading.
If you run an online store, this guide covers how CVV data moves through a checkout, what your processor should be doing with it, and the specific parameters to check before you sign a contract.
What a CVV actually is
The three or four digit code on a card is called CVV2 by Visa, CVC2 by Mastercard, and CID by American Express. Its only job is to prove that whoever typed the card number is holding the physical card. Because the code is checked at authorization and cannot be re-verified later, the payment card industry treats it as sensitive authentication data. The rule is blunt: it may pass through your gateway during the transaction and it must not be retained afterward in any form, including logs, backups, spreadsheets, or customer records.
That single rule is why a stolen CVV has a short shelf life and why the underground market built around it is full of stale inventory and deliberate fraud.
Why no legitimate marketplace can exist
- Card issuers do not sell cardholder verification data, and no acquirer, processor, or bank is permitted to broker it.
- Anyone holding a live CVV for resale obtained it from a breach, a skimmer, or a phishing kit. There is no lawful supply chain.
- Reputable payment businesses compete on stopping this traffic, not hosting it. A vendor that promotes it is advertising a crime.
How fake CVV markets operate
The pattern repeats across sites that claim to be trustworthy escrow services. Payment arrives by irreversible method, then the goods never do. Common mechanics include deposit-only balances with withdrawal terms that never clear, sample cards that were canceled before they were posted, and fake escrow accounts run by the same operator as the shop.
- A "trusted vendor" reputation is unverifiable because the marketplace controls every review and every rating.
- Buyers who complain are banned, which removes the only evidence trail.
- Some operations harvest the buyer's own identity and banking details during signup, then monetize that instead of the cards.
If a service asks you to fund a wallet to see inventory, the inventory is not the product. You are.
What merchants should buy instead
If the underlying goal is a checkout that survives fraud and stays in the lightest compliance tier, evaluate providers against the parameters below. These are the numbers that separate a real payment security product from a reseller with a logo.
Parameter bands to check
- PCI DSS scope: target Self-Assessment Questionnaire A or A-EP. Full SAQ D means card data touches your servers, which raises cost and risk.
- Standard version: confirm the provider attests to PCI DSS v4.0, the current revision, and posts an Attestation of Compliance.
- Tokenization: network tokens or provider tokens should replace the account number after the first transaction. Ask whether tokens are portable if you switch processors.
- 3-D Secure: modern 3DS 2.x with risk-based authentication. Expect a challenge rate in the single digits as a percentage of orders once the model warms up.
- Dispute ratio: card networks flag merchants around 0.9 percent of transactions in disputes. Keep your own rate under 0.5 percent for headroom.
- Authorization rate: well-tuned gateways land between 97 and 99 percent on valid domestic cards. Anything far lower signals routing or data quality problems.
- Retention policy: zero retention of CVV, and a defined window of 12 to 18 months for other transaction fields unless a legal hold applies.
- Logging: confirm that card codes are masked in application logs and excluded from analytics and error reporting tools.
If your own card data was exposed
Call the number on the back of your card first. Under federal billing rules, prompt reporting caps your liability for unauthorized charges, and most issuers will reissue the card within a few days. Then file a report, because a single complaint is what connects your case to a larger operation.
If someone approached you offering to buy your card details, treat that message as evidence. Do not reply and do not send a sample. Forward it to your bank's fraud team and report it to the FBI's Internet Crime Complaint Center.
FAQ
Is selling a single CVV a crime?
Yes. Card verification data belongs to the cardholder and the issuing bank. Selling it, or buying it, is treated as fraud or access device misuse in every United States jurisdiction, and the fact that only one card is involved does not change the charge.
Can a small test transaction prove a seller is legitimate?
No. A working sample proves only that one card was still valid at that moment. It says nothing about whether the rest of the inventory exists, whether the shop will disappear, or whether law enforcement already controls the operation.
What if someone offers to buy my own CVV?
That is a solicitation to commit fraud, and it is also a common setup for identity theft. Delete it, tell your issuer, and check your account activity for the following months.
How do I verify a payment provider handles card codes correctly?
Ask for three documents: the Attestation of Compliance or a current PCI report on compliance, a data flow diagram that shows where the CVV travels, and a written statement that the code is not stored after authorization. A provider that hesitates on any of the three is not the one to buy.
Bottom line
There is no trusted place to sell CVV data, and looking for one is the wrong purchase. Spend the budget on a compliant gateway, tokenization, and 3-D Secure, and the card codes that fraudsters want never sit on your systems long enough to be taken.