Selling CVV dumps is illegal in the United States. There is no lawful step-by-step process. The phrase describes a criminal market. Sellers offer card data taken from payment cards. Buyers use the data to make unauthorized purchases or to make cloned cards. Federal law treats both sides as felonies.
What "CVV" and "dumps" mean
CVV stands for Card Verification Value. It is a short security code printed on a payment card. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it the CID. American Express prints four digits on the front of the card. Visa and Mastercard print three digits on the back, next to the signature panel.
A dump is different. A dump is data copied from the magnetic stripe of a card. Track 1 and Track 2 hold the account number, expiration date, name, and service code. A dump does not come from a merchant receipt. It comes from a skimmer, a compromised terminal, or a breached payment system.
Why selling or buying card data is a federal crime
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. A payment card and its account number are access devices. The statute covers producing, selling, transferring, and possessing card data with intent to defraud. A conviction carries up to 10 years in prison and fines. Prior convictions raise the maximum term.
18 U.S.C. 1028A adds a mandatory two-year sentence when stolen card data is used to commit identity theft. Wire fraud, 18 U.S.C. 1343, covers the online sales and payments used to move the data. State laws add separate charges for trafficking in stolen property and for computer crimes.
How the card networks protect CVV data
PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. The card verification code is on that list, along with full magnetic stripe data. A merchant may use the CVV to approve one transaction. The merchant cannot keep it in a database.
Issuers use the CVV during authorization. The merchant sends the code with the transaction. The issuer compares it to its record. A mismatch triggers a decline or a fraud review. Modern defenses add tokenization, which replaces the account number with a token, and EMV chip cryptograms, which cannot be replayed.
What to do if card data is exposed
Call the card issuer. The number is on the back of the card. The issuer cancels the account and issues a new number. Review statements for charges that were not made.
Report identity theft at IdentityTheft.gov, operated by the Federal Trade Commission. The site produces a recovery plan and an FTC Identity Theft Report. File a complaint with the FBI Internet Crime Complaint Center at ic3.gov. Both reports help issuers and law enforcement.
What is not documented
Exact volumes of the dump market, current pricing, and the size of specific criminal forums are not verifiable from public, reliable sources. Estimates appear in vendor reports. The methods behind those estimates are often not disclosed.