Selling CVV dumps for bitcoin is card fraud. A CVV dump is a set of stolen payment card records, and trading those records for cryptocurrency is a federal crime in the United States under access device fraud and wire fraud laws. Sellers, buyers, and the forums that host them all face prison time, fines, and restitution to the people whose cards were used.
The useful question for shoppers and merchants is not where card data changes hands. It is how that data gets taken, and why most of it stops working the moment someone tries to spend it.
What is a CVV dump?
A CVV dump is a batch of card records pulled from a breach, a skimmer, or a phishing page and packaged for resale. The name comes from the security code printed on the card, which criminals treat as the valuable part of the record.
how to sell cvv with bitcoin anonymous
What information sits in a dump?
Most records carry the card number, expiration date, cardholder name, and billing address. Some add the three-digit code from the back of the card, and a smaller share include the magnetic stripe data. Online merchants check that code, which is why a record without it sells for less.
Where does stolen card data come from?
Card data leaks through skimming hardware on fuel pumps and ATMs, malware on point-of-sale terminals, fake checkout pages built to copy a form, and large merchant breaches. Each route is a crime scene with a victim, not a supply chain. Bank rules require merchants to protect that data, and regulators fine the ones that fail.
Why do fraud rings ask for bitcoin?
Bitcoin crosses borders without a bank in the middle, and a payment cannot be pulled back by the sender once it confirms. That mix of speed and finality appeals to people moving stolen goods. Cash has the same quality, but cash cannot be sent across an ocean in ten minutes.
Crypto is also a poor hiding place. Blockchain analysis firms cluster wallets and trace flows, and most exchanges demand identity documents before a coin becomes spendable money. US prosecutors have charged operators of card shops who believed crypto hid their identity.
Is selling CVV dumps for bitcoin illegal?
Yes, in every US state. Federal law at 18 U.S.C. § 1029 makes it a crime to traffic in access devices, a category that covers card numbers, security codes, and account credentials. A basic offense carries up to 10 years in prison, and cases involving larger volumes of devices reach 15 years. Wire fraud charges under 18 U.S.C. § 1343 and identity theft charges under 18 U.S.C. § 1028 stack on top, and courts order restitution to victims.
State prosecutors file their own counts. Cardholders can also sue for damages. A deal that feels like a private transaction between strangers becomes evidence in a federal case.
Does buying a dump carry the same risk?
Yes. Possession with intent to defraud and use of a stolen card number are separate crimes from selling one. Buying records and using them to place orders adds mail fraud and money laundering counts in many prosecutions.
How does the payment industry make stolen card data useless?
Banks and card networks assume card data will leak, so they build defenses that assume the worst. Each layer strips value from a stolen record.
CVV and CVC verification
The security code is not stored with the card number, so it rarely falls out of a database breach. PCI DSS forbids merchants from keeping the code after an order authorizes. A criminal who holds a card number and an expiration date still hits a wall at checkout.
Tokenization and network tokens
Tokenization swaps the real card number for a stand-in that works only for one merchant, one device, or one subscription. A stolen token fails everywhere else. Mobile wallets go further and never hand the underlying number to the merchant at all.
3-D Secure and step-up checks
3-D Secure pushes the order to the bank's own app for a fingerprint, a face scan, or a one-time code. A card number alone cannot answer that prompt. Issuers apply the check to risky orders, so most shoppers never see it.
Risk scoring, address checks, and velocity rules
Merchants compare the billing address to the one on file, watch for many orders from one device, and flag a mismatch between the shipping country and the card's issuing country. Fraud models score each order before it reaches the processor, and a card-testing burst shows up as a run of small declines.
What should online merchants do?
Merchants carry the loss when a stolen card clears, so the controls below pay for themselves.
- Turn on CVV verification and 3-D Secure for high-risk orders, new accounts, and shipping addresses that differ from the billing address.
- Never store the CVV, full track data, or PIN blocks. PCI DSS prohibits it, and a leak of that data invites fines and lost card processing rights.
- Use tokenization so your systems hold tokens instead of card numbers.
- Watch for card testing: small repeated charges, bursts of declines from one device, or many orders placed in a few minutes.
- Tie fraud rules to order value, account age, and recent changes to the shipping address or email.
- Track chargebacks by item and by region. A spike is early warning, not a paperwork problem.
What should shoppers do?
You cannot control a merchant's database, but you can limit what a leak exposes.
- Pay with a mobile wallet or a virtual card number when the store offers one. Both keep your real number out of the merchant's systems.
- Read statements and set transaction alerts in your bank app.
- Freeze the card from the app if a charge looks wrong, then dispute it in writing.
- Report identity theft to the FTC and file a complaint with the FBI's Internet Crime Complaint Center if you lost money.
- Never send photos of a card through chat, email, or a marketplace message. No real buyer needs that.
Does the CVV protect you when the card number leaks?
In part. The code stops a criminal who holds only the card number and the expiration date, which is the most common leak of all. It does not stop a phishing page that asks for every digit at once, and it does not help if a merchant breaks the rules and keeps the code on file. That is why the code is one layer, not the whole defense.
The pattern holds across every case: the tools that make card data hard to reuse, such as tokens, step-up checks, and code verification, do more to stop fraud than any single rule about where data may travel.