Ads that offer to sell CVV numbers at a cheap price in bulk are selling stolen card data, recycled breach records, or nothing at all. Buying card verification values is a federal crime in the US under 18 U.S.C. § 1029, and the codes stop working the moment the issuer kills the card, which happens within days of a breach. The low price is the giveaway: a seller holding 10,000 live cards has no reason to sell them for two dollars each.
What is inside a bulk CVV listing
A CVV is a three or four digit code printed on a card or generated inside a digital wallet. Its single job is to prove the person at checkout holds the physical card. A code has no value on its own because it dies with the card it belongs to.
Sellers who advertise bulk files pull from two sources.
Where to Sell CVV Cheap Price: A Complete Buying Guide
- Real card data skimmed at terminals, phished through fake checkout pages, or leaked in a merchant breach. Files pair numbers with names, ZIP codes, and expiration dates.
- Fabricated or recycled data built from random number generators or old breach dumps, sold to buyers who cannot test a sample before paying.
Most bulk offers mix the two. The working cards get used by whoever holds them; the rest go into the file that ships to the buyer.
Why the price is the warning sign
Live card data carries risk for anyone who holds it. Every test charge leaves a log with an IP address, a device fingerprint, and a payment trail that outlives the card.
Cheap bulk pricing exists for dead, expired, and invented records. The seller earns money from the file itself, not from the cards inside it.
Legal exposure on both sides of the deal
The law covers buyers and sellers with the same statute.
- 18 U.S.C. § 1029 makes it a crime to produce, sell, or possess access devices with intent to defraud. Felony terms apply, and repeat offenses carry longer sentences.
- Wire fraud and identity theft charges stack on top when data crosses state lines or gets used to open accounts in someone else's name.
- A purchase order, chat log, or wallet transfer becomes evidence of intent. Buyers are not treated as victims.
- Card networks run chargeback monitoring programs that shut down merchants and processors tied to card testing schemes.
How issuers catch bulk data at checkout
- CVV check. The issuer compares the submitted code to the one on file. A mismatch declines the charge at authorization.
- Address Verification Service. The billing street number and ZIP get matched against issuer records.
- Velocity and device rules. Many small orders from one IP range, device, or BIN range flag the account.
- EMV 3-D Secure. The cardholder approves the purchase with a one-time code or a banking app prompt.
These checks finish in under two seconds. Bulk data fails them at scale, which is why a card testing attack shows up as long strings of small declines instead of one large charge.
What legitimate bulk card services do
Businesses that handle thousands of cards use a payment processor, not a card file. Tokenization swaps the card number for a value tied to one merchant, one device, or one subscription.
- Network token services replace the account number with a token that works only inside the agreed scope.
- PCI DSS Level 1 processors store and transmit card data under audited controls.
- Recurring billing keeps a token or transaction ID, never the CVV.
PCI DSS bars merchants from storing the CVV after authorization in any form. A vendor who claims to hold CVV data in bulk for later use fails that rule by definition.
What to do if your card turns up in a dump
- Call the number on the back of your card and report it as compromised. The issuer cancels it and mails a replacement.
- Read the last 60 days of statements for charges you do not recognize.
- Freeze your credit at all three bureaus so new accounts cannot open in your name.
- Report the theft at IdentityTheft.gov to get a recovery plan and a paper trail.
- File a complaint with the FBI Internet Crime Complaint Center if money left your account.
Federal law caps your liability for unauthorized credit card charges, and many issuers waive the rest. Speed matters more than the amount.
How merchants stop bulk card testing
- Require CVV and AVS on every card-not-present order, with no exceptions for returning customers.
- Rate limit checkout attempts by IP, session, and device fingerprint.
- Watch BIN ranges for spikes in declines and block ranges tied to testing.
- Turn on 3-D Secure for high-risk orders and first-time buyers.
- Tokenize stored cards so a future breach yields tokens instead of card numbers.
- Use hosted payment fields to keep card data out of your own systems and inside PCI DSS scope.
Frequently asked questions
Is it legal to buy CVV numbers in bulk?
No. Buying access device data with intent to defraud violates 18 U.S.C. § 1029 in the US, and similar statutes apply in most countries. A payment record, chat message, or downloaded file serves as evidence of that intent.
Why are bulk CVV listings so cheap?
Because the records are dead, stolen from an old breach, or invented. A file priced at cents per record cannot hold live cards, since live cards are worth more to the holder than the listed price.
Can a merchant spot a stolen CVV before the charge clears?
Sometimes. CVV mismatch, AVS failure, and 3-D Secure challenges stop a large share of stolen-card attempts at authorization. Bulk data has no way to pass those checks on demand.
Does a CVV change when a card is reissued?
Yes. A replacement card arrives with a new number, a new CVV, and a new expiration date. That is why data from a six-month-old breach has almost no chance of working.
Bottom line
There is no legitimate wholesale market for CVV codes. Any site that pitches bulk pricing is trading stolen records, recycled data, or nothing, and the buyer carries the legal risk either way. If your real goal is safe online checkout, the tools that matter are tokenization, 3-D Secure, and a card that alerts you to charges in real time.