Short answer first
There is no legal marketplace, cheap or otherwise, where you can sell CVV or CVC data. The three digit code printed on a card is cardholder authentication data. Payment card industry rules forbid merchants from retaining it after a transaction is authorized, and federal and state law in the United States treat the sale of card data as fraud or identity theft. Sites advertising cheap CVV listings are criminal operations, law enforcement stings, or scams that target the person posting the data.
If you run an online store and your real question is how to handle the CVV field safely, the guide below covers the parameters to check before you buy a payment tool or sign with a vendor, plus the pitfalls that cost merchants the most.
Prerequisites
- A written scope of which card data your business touches, stores, or passes through
- Your current PCI DSS Self-Assessment Questionnaire level and the last attestation date
- A named owner for payment security inside the company
- Access to your checkout codebase and log configuration
What cheap CVV listings are
Listings that promise bulk card numbers with CVV codes for a few dollars per record fall into three groups. Some are outright fraud against the buyer, selling recycled or invented numbers. Some are criminal storefronts that disappear with the payment. Some are run by investigators collecting evidence. In all three cases the data is stolen, the transaction is a crime, and the person who offers the data is the first party identified when a breach is traced.
How to vet a payment vendor on CVV handling
- Request the vendor's PCI DSS Attestation of Compliance and confirm the scope covers card-not-present channels.
- Get written confirmation that the vendor never retains CVV2 or CVC2 values after authorization, including in logs, support tickets, and analytics events.
- Ask for a data flow diagram that shows where the CVV field enters and where it is discarded.
- Run a test transaction in the vendor sandbox and inspect your own application logs for the three digit value.
- Ask for the breach notification window and the name of the forensic partner the vendor uses.
- Put breach cost allocation and indemnity terms in the contract before you sign.
- Repeat the review every year and after any change to your checkout flow.
Pitfalls
- A vendor that says "PCI compliant" but will not produce an attestation document
- Tokenization that stores the original card number alongside the token
- Free online CVV generator or checker tools, which are malware delivery vehicles
- Customer support workflows that ask shoppers to email a photo of the card
- Analytics or session replay scripts that capture the checkout form field by field
- Anyone who offers to buy card data from you, which is a crime to accept
If you find card data exposed
- Stop the capture at the source and remove the stored values.
- Notify your acquiring bank and your PCI compliance contact.
- File a report with the FBI Internet Crime Complaint Center and the Federal Trade Commission.
- Commission a forensic review before you restore normal checkout traffic.