Selling CVV numbers is a federal crime in the United States. The CVV (card verification value) is the three or four digit code printed on a payment card, and its only job is to prove that the person paying holds the physical card. Trading that code for money means selling stolen financial data, which brings prison time, fines, and a criminal record.
What is a CVV, and why do thieves want it?
Banks print the CVV on the card but never store it in the magnetic stripe or the chip. Online merchants ask for it to confirm the buyer has the card in hand. That one detail is what makes a stolen card number useful to a criminal.
A card number alone gets declined at any store that requires the code. With the CVV attached, a stolen card looks like a normal online purchase, at least until the real owner checks the statement.
- Visa, Mastercard, and Discover use a three digit code (CVV2) on the back.
- American Express uses a four digit code (CID) on the front.
- The code changes when the card is reissued, so stolen data goes stale.
Is selling CVV data legal in the US?
No. Federal law treats a card number and its CVV as an access device, and moving one for profit is a felony under 18 U.S.C. § 1029.
- 18 U.S.C. § 1029 covers the sale, transfer, and possession of access devices with intent to defraud.
- Penalties start at up to 10 years in prison and rise for repeat offenses or larger operations.
- 18 U.S.C. § 1028A adds a mandatory two year sentence when identity theft is involved.
- State fraud and stolen property laws add charges on top of the federal case.
How does the stolen card market work?
Card data leaks from breaches, skimmers on gas pumps, and phishing pages that copy a checkout screen. Sellers bundle numbers with matching codes and offer them to buyers who want electronics, gift cards, or resale inventory.
Buyers get burned in most cases. A large share of listings are fake, and some are run by the same people who will later use the buyer's own payment details.
Why do searches for "sell CVV" lead to trouble?
Results for the phrase mix scam pages, phishing sites, and law enforcement operations. A person who responds to a listing hands a stranger contact details, a payment method, and evidence of intent.
Buyers seldom receive working data. Sellers take the payment and vanish, or they send numbers that were canceled weeks earlier, which leaves the buyer with a loss and no recourse.
How do cardholders spot a stolen CVV?
- A charge you do not recognize, often small at first.
- A replacement card arriving when you did not request one.
- An account alert for a purchase in another state or country.
- A drop in available credit that you cannot explain.
Test charges are common. Thieves run a $1 to $5 purchase to confirm the card works before they spend more. That small charge is your warning shot.
How do you protect your CVV?
Treat the code like cash. Anyone who asks for it by phone, text, or email is asking for the ability to spend your money.
- Never read the code to a caller who contacted you first.
- Skip saved cards in browsers on shared or public devices.
- Use a virtual card number for subscriptions and unfamiliar sites.
- Turn on purchase alerts for every transaction above a low threshold.
- Cover the back of the card when you hand it to a cashier.
- Check your statement each week instead of once a month.
What should you do if your CVV is exposed?
Call the number on the back of your card and ask for a replacement. The bank issues a new card number and a new CVV, which kills the stolen data at the source.
Then file a report. The FTC's identity theft site builds a recovery plan step by step, and a police report helps if you need to dispute charges or clear your credit file.
Frequently asked questions
Can you sell a CVV that belongs to your own card?
No. Handing your card data to another person still transfers an access device for use in fraud, and you carry the same exposure as any other seller. You also stay liable for the debt until the bank resolves the dispute.
Does the CVV ever change?
Yes. A new code comes with every reissued card, so a stolen CVV has a shelf life measured in months at best. That short window is one reason card networks keep the code off the stripe.
Is a CVV the same as a PIN?
No. The PIN authorizes a card at an ATM or a chip terminal. The CVV authorizes a card-not-present purchase online, by phone, or through an app.
Why do some stores ask for the CVV every time?
That request is a security check, not a red flag. Merchants who require the code on each order cut their risk of chargebacks from cards reported stolen.
What happens if you buy CVV data and get caught?
Buyers face the same access device charges as sellers. A first offense can bring a felony conviction, restitution to the card issuer, and a ban from holding accounts at major banks.
The bottom line
There is no legal way to sell a CVV, and no safe way to buy one. The code exists to protect the cardholder, and the protections around it only work when the code stays private.