What the listings claim
Telegram groups advertising "cheap CVV" post card numbers, expiry dates, and 3-digit codes in bulk. Quoted prices run from a few dollars to roughly $30 per record. Sellers use terms such as "valid rate," "BIN," and "fresh base." None of that data comes from a bank, a card network, or a payment processor.
Cheap CVV Sales on Telegram: A Buyer's Reality Check
What the law says
U.S. law classifies a card number, expiry date, and CVV together as an "access device." Title 18, Section 1029 of the U.S. Code makes it a crime to produce, traffic in, or possess access devices with intent to defraud. Penalties reach 10 years for a first offense and 20 years for repeat offenses or cases with high losses. Buying or selling a card record is a federal felony. There is no resale market with a lawful side.
How CVV and CVC work on a real checkout
Visa prints the code as CVV2, Mastercard as CVC 2, American Express as CID, and Discover as the Card Identification Number. Three digits on most cards, four on American Express. The card issuer generates the value and matches it during authorization. The merchant gets back a match, a no-match, or a not-processed result.
The PCI Data Security Standard treats the printed code as sensitive authentication data. Requirement 3.3.1 in PCI DSS version 4.0 states that this data is not retained after authorization, even if encrypted. The earlier version 3.2.1 carried the same rule as Requirement 3.2. A merchant that stores your CVV violates the standard.
Parameters that matter at checkout
- Address Verification Service (AVS): the issuer checks the billing street number and ZIP code against its own record. Coverage varies by country.
- 3-D Secure: Visa Secure, Mastercard Identity Check, and Amex SafeKey add an authentication step. A successful authentication usually moves chargeback liability to the issuer.
- Tokenization: the card number is swapped for a token. The merchant never sees the CVV after the first authorization.
- Decline codes: "CVV mismatch" is one code among many. A mismatch alone does not prove fraud.
Pitfalls
- Telegram offers no buyer protection and no refund path. Payment usually goes through crypto, which cannot be reversed.
- Sellers post screenshots of other people's balances. The screens are easy to fake.
- Behind a "carding" purchase sits malware, phishing kits, or a stolen identity. Buyers pick up the criminal exposure without reliable data.
- Test transactions trigger fraud rules at the issuer. Cards get closed within hours, so the data has a short shelf life.
- The FBI Internet Crime Complaint Center recorded 880,418 complaints and $12.5 billion in reported losses in 2023. Card and payment fraud is one of the largest categories.
If your card number or CVV is exposed
Call the number on the back of the card and ask for a replacement card and a new account number. Review the last 60 days of transactions. Dispute charges you did not make in writing, and keep the reference number. Report the incident to the FTC at IdentityTheft.gov, and file a complaint with the FBI Internet Crime Complaint Center. Freeze your credit at all three bureaus if your Social Security number was also exposed.