Selling CVV data is a federal crime in the US, and no legitimate company sells card verification values as a standalone product. Listings that promise to sell CVV cheap point to fraud forums, stolen account data, or plain scams. The code belongs to the cardholder's bank account and cannot be bought, transferred, or stored by a merchant.
What is the CVV code and why can't it be sold?
The CVV is a 3-digit code on the back of Visa, Mastercard, and Discover cards, and a 4-digit code on the front of American Express cards. Issuers print it when a card is made, and it stays tied to that one account. That is the point of the code: it proves the person typing the number holds the physical card.
- It never appears on receipts, statements, or card mailers.
- PCI DSS Requirement 3.2 bans storing it after a transaction, even in encrypted form.
- It stays the same unless the card is reissued.
Anyone who offers to sell a CVV is passing along stolen account data or inventing numbers. There is no wholesale source and no discount tier that changes that.
Why are cheap CVV offers a trap?
Two outcomes wait at the end of a cheap CVV purchase: a criminal charge or an empty wallet. Often both.
How to Buy Cheap CVV & Bitcoin: A Comprehensive Guide
The legal risk
18 U.S.C. § 1029 covers trafficking in access devices, and buying card data carries the same exposure as selling it. Basic offenses bring up to 10 years in prison, with longer terms for aggravated cases. Prosecutors do not need a complaint from the cardholder to charge someone who holds bulk card data.
The practical risk
Fraud markets run on copied files and repeat sales, so the same numbers get sold to many buyers at once.
- Payment in crypto leaves no refund path and no chargeback.
- Cards get canceled or emptied before delivery.
- Live check claims cannot be proven, and they exist to create urgency.
- No forum, chat group, or vendor offers real recourse.
- Prices far below real processing costs (about 1.5% to 3.5% plus a small fixed fee) signal stolen or fake data.
What should you do if your card data shows up for sale?
Act on the assumption that the number is compromised, even when you see no charge yet.
- Freeze the card in your banking app and call the number on the back.
- Ask for a new card number, not a replacement card with the same digits.
- Turn on alerts for every transaction, including small ones.
- Read statements for test charges of a dollar or less.
- File a report at IdentityTheft.gov and save the confirmation.
- Pull your credit reports and dispute accounts you do not recognize.
What are safer options for card-not-present payments?
If you want to pay online without handing your main card number to every merchant, your issuer offers tools for that.
- Virtual cards from your bank: a fresh number per merchant or per purchase.
- Digital wallets: the merchant receives a token, not your card number.
- Retail prepaid cards: a fixed balance caps what a thief can take.
- Business virtual card programs: spend limits per vendor and per billing cycle.
Each option keeps the CVV with the issuer and the cardholder. None of them involves a third party selling codes.
How should merchants handle CVV data?
A merchant that stores CVV data breaks PCI DSS and absorbs the fraud losses that follow a breach.
- Require the CVV on card-not-present orders and send it straight to the processor.
- Never ask for a CVV by email, chat, or phone.
- Pair the CVV check with address verification and 3-D Secure on risky orders.
- Train support staff to refuse any request to read a code back to a caller.
FAQ
Is selling CVV data legal?
No. Trafficking in payment card data is a crime in the US under 18 U.S.C. § 1029, with similar penalties in Canada, the UK, and the EU. A seller who claims otherwise is lying about the law, not about the price.
Can one CVV code be used for many purchases?
The code stays the same for the life of the card, but merchants cannot keep it after a transaction. That limits how long a stolen code works before the bank cancels the card.
Why is the price so low?
Stolen card data costs nothing to copy, and a seller will resell the same batch to many buyers. Listings that sell CVV cheap reflect oversupply, not a bargain.
What should a merchant do when someone offers to sell card data?
End the conversation, keep the messages as evidence, and report it to your payment processor and to the FBI's IC3.
Card verification exists to protect the cardholder, and it works only when the code stays with the issuer and the buyer. Anyone selling it cheap is selling stolen data, and the buyer carries the legal exposure that comes with it.