The short answer
No legitimate business sells CVV data. The card verification value is a short security code whose entire purpose is to prove that a specific cardholder authorized a specific transaction. Card issuers, card networks, payment processors, and merchants do not offer CVVs for sale, and no compliant payment provider buys them. Any storefront, forum thread, or private message offering CVVs for sale is offering stolen, expired, or invented data. Buying, selling, or using it is a federal offense in the United States, which is why the honest answer to "where can I sell CVV" is that the question has no lawful version.
What the CVV or CVC code actually does
A CVV is three digits on the back of most cards, or four digits on the front of American Express cards. It is printed but not encoded on the magnetic stripe, and it is not part of the number that gets embossed on the card. That design choice matters. When a shopper types a card number into a checkout page, the CVV check confirms the person has the physical card in hand. A stolen card number alone is not enough to complete most card-not-present transactions, which is exactly why stolen databases are marketed by people who claim to have the codes attached.
Card networks built the check as a fraud control. It does not authenticate the cardholder's identity, and it does not guarantee the transaction is safe, but it raises the cost of fraud for anyone working from a leaked number list.
Why merchants cannot store or resell CVV data
The PCI Data Security Standard classifies the CVV as sensitive authentication data. Merchants and processors are prohibited from retaining it after a transaction is authorized, even in encrypted form. That single rule explains why there is no legitimate secondary market: a compliant business has nothing to sell because it is not allowed to keep the code in the first place.
Trafficking in card numbers and verification codes falls under federal access device fraud statutes, and the penalties apply to the seller, the buyer, and anyone who uses the data at checkout.
Three legitimate ways merchants handle the CVV check
If your interest in this topic comes from running an online store, these are the real options. Each one keeps you compliant and keeps the code out of your own systems.
Tokenization through the payment processor
- Pros: the card number and CVV never touch your servers, so your compliance scope shrinks. Recurring billing and refunds work through the token instead of the raw data.
- Cons: you depend on the processor's uptime and pricing. Switching providers later means re-tokenizing customer cards with fresh consent.
Use this when you run subscriptions or any store that wants to avoid storing card data at all.
Collection and immediate purge
- Pros: simple to implement, and it satisfies the rule against post-authorization storage. The code is used once for the authorization and then discarded.
- Cons: you cannot re-run a charge later without asking the customer for the code again. Any logging or error-tracking tool that captures form fields can accidentally retain it.
Use this when you take one-time payments and have audited your logs for stray form data.
3-D Secure authentication
- Pros: the issuer verifies the cardholder during checkout, which shifts liability for certain fraud chargebacks away from the merchant.
- Cons: added checkout steps can reduce conversion, and some legitimate customers get declined when the authentication step fails.
Use this when your chargeback rate is high or you sell high-value goods that attract fraud attempts.
If someone offers to sell you CVV data
- Do not reply, send payment, or test the data. Testing a stolen card is itself a crime.
- Report the listing or message to the platform hosting it.
- File a complaint with the FBI Internet Crime Complaint Center if you were solicited or lost money.
- Report consumer fraud to the Federal Trade Commission, which feeds patterns into law enforcement databases.
- If your own card data was exposed, contact your issuer, freeze the card, and review recent statements for charges you do not recognize.
Bottom line
There is no legitimate CVV market to buy into or sell into, so treat any offer as a fraud signal and walk away. If you are a merchant, the practical move is tokenization through a PCI-compliant processor, plus a written rule that the CVV is used for one authorization and never logged, stored, or shared. If you are a shopper, the CVV check is one of the few controls standing between a leaked card number and a completed fraudulent purchase, so keep the code off screenshots, chat messages, and any form that is not your bank or a store you chose to buy from.