The short answer
No legitimate business buys CVV dumps. A CVV is a 3 or 4 digit code on a payment card. It verifies that the card is present at the time of a transaction. Card networks and issuers classify it as sensitive authentication data. PCI DSS Requirement 3.2 bars storage of that data after authorization. A firm that buys card numbers with CVVs cannot keep a merchant account, cannot process payments, and cannot pass a compliance audit.
Two groups pay money for card data: criminal operations and fraud investigators. Both cost the seller.
What US law says
Selling card data is a federal crime. 18 U.S.C. § 1029 covers access device fraud. Sale, transfer, or possession of card numbers with intent to defraud carries up to 15 years per count plus fines. 18 U.S.C. § 1028A adds a mandatory 2 year term for aggravated identity theft, served after any other sentence. 18 U.S.C. § 1343 covers wire fraud and carries up to 20 years. Terms stack across counts.
The US Secret Service handles payment fraud cases. The FBI runs the Internet Crime Complaint Center. Both accept reports from the public, including reports from people who took part in a scheme.
Is It Easy to Sell CVV Dumps? No, and Here Is Why
Parameters to check before any transaction
- License. Ask for a state money transmitter license or a registered ISO agreement. Legitimate buyers of payment data for testing hold written authorization from the card issuer.
- Contract. A real data purchase has a statement of work, a defined scope, and a payment trail.
- Data handling policy. PCI DSS Requirement 3.2 prohibits retaining CVV after authorization.
- Identity. Fraud units identify themselves. Criminal sites do not.
Pitfalls
- Escrow fraud. The escrow account belongs to the buyer.
- Exit scams. The market closes after deposit and removes the balance.
- Test charges. Small charges trace back to the seller account.
- Money mule charges. Moving proceeds adds a separate offense under 18 U.S.C. § 1956.
- Log retention. Site operators keep IP logs and transaction records. Those records appear in indictments.
Legal ways to get paid for card security work
Card networks and issuers pay for vulnerability research through published bug bounty programs. The PCI Security Standards Council publishes standards and takes member feedback. Merchants hire penetration testers under contract. These routes pay in currency that clears a bank.