The direct answer
"Sell CVV dumps for money" is carding vocabulary. A dump is a copied set of card credentials, usually the track data lifted from a magnetic stripe together with the card verification value. People searching that phrase want a buyer, a seller, or a market. All three are illegal in the United States, and most of what surfaces is bait: a scam aimed at whoever shows up holding data, or an undercover account run by investigators. There is no legitimate version of this transaction, which is the part the pitch never mentions.
What is actually inside a dump
Card data gets priced by how much of it still works and where it can be used. I look at the same three pieces whenever someone forwards me one of these listings:
Selling CVV Dumps on the Dark Web: Why It Is a Federal Crime
- Track data. Track 1 and Track 2 are the stripe payloads. They matter for cloning a physical card at a terminal.
- CVV2 or CVC2. The three or four digit code printed on the card, which online checkout forms ask for.
- Fullz. A bundle that adds the cardholder name, billing address, and sometimes a Social Security number or bank login.
The split between card-present and card-not-present data is why the market lists them separately. A cloned stripe fails on a chip reader. A CVV2 alone fails the moment the issuer flags the account. Neither problem is solved by buying more of the same.
Why the quick-money angle is a trap
The economics look simple in a forum post and fall apart in practice. Four patterns show up over and over:
- Advance-fee scams. The buyer asks the seller to cover a verification fee, escrow deposit, or "test charge" before the supposed payout. The fee disappears.
- Rippers. The buyer takes the data, blocks the seller, and resells it to someone else. There is no recourse, because nobody in the chain can call the police.
- Stings. Federal agents pose as buyers, log the handoff, and build the case from the seller's own messages and payment records.
- Money mule exposure. Routing proceeds through a personal bank account turns a data offense into money laundering, which carries its own separate counts.
A market where every participant is a criminal has no dispute resolution. That is the structural reason this offer never pays what it promises.
Legal exposure in the US
Access device fraud under 18 U.S.C. Section 1029 covers producing, selling, and trafficking stolen card credentials. Basic offenses carry up to 10 years, and certain aggravated conduct reaches 15. Wire fraud under 18 U.S.C. Section 1343 adds up to 20 years when the scheme crosses state lines, which any online sale does. Aggravated identity theft under 18 U.S.C. Section 1028A imposes a mandatory two-year term that runs consecutively to whatever else is imposed, and it applies whenever the data belongs to a real person. State statutes stack on top of all of it.
"I did not know it was stolen" does not survive a listing that advertises dumps by name. Intent is drawn from the language of the ad itself.
If your job touches card data
Merchants, processors, and support teams have a straightforward obligation: never store sensitive authentication data after authorization. PCI DSS Requirement 3 spells this out for the full track, the CVV2, and the PIN block. Tokenization and point-to-point encryption exist precisely so a database breach yields nothing usable. If you handle disputes or chargebacks, treat any file containing a full card number as a controlled record, not a spreadsheet.
If your own card is exposed
- Lock the card in your issuer's app before you call anyone.
- Ask for a new account number, not just a replacement card. Reissued plastic on the same number keeps the exposure alive.
- Check your credit reports from all three bureaus and dispute any account you do not recognize.
- Report at IdentityTheft.gov, and file with the FBI's Internet Crime Complaint Center if money actually moved.
Legitimate work in the same space
Payment security is a real career. Fraud analysts, chargeback specialists, and PCI compliance auditors all work with the same data concepts from the defensive side, and they get paid without a criminal record attached. If the appeal of the phrase was the money, that path exists and it is legal.
Bottom line
Offers to sell CVV dumps for money describe a felony, and the people running them are usually stealing from each other or working with investigators. Nothing about the pitch holds up once you look at the legal code, the payment rails, or the incentives of the other party.