There is no lawful method to sell CVV dumps on Telegram. A CVV dump is card data copied from a payment card without the cardholder's knowledge. Offering that data for sale is trafficking in unauthorized access devices under 18 U.S.C. Section 1029. A first offense carries up to 10 years in federal prison, and several subsections carry up to 15 years. Pairing the card data with a victim's name or Social Security number can add a mandatory two-year consecutive term under 18 U.S.C. Section 1028A. Telegram's Terms of Service bar the activity, and federal prosecutors have charged channel operators.
What a CVV dump contains
- The 16-digit primary account number
- Expiration date
- CVV or CVC verification code
- Cardholder name and billing address in larger sets
- Magnetic stripe track data in some files
A single card record sells for a few dollars. Sets that include a full identity, sometimes labeled fullz, sell for more. The pricing reflects the extra work needed to open accounts or pass identity checks.
Why the sales are illegal
Three federal statutes cover the conduct. Section 1029 covers access device trafficking. Section 1028A covers identity theft tied to the card data. Section 1343 covers wire fraud when the seller uses interstate networks to move money. State laws add charges for larceny and computer crimes. Telegram is a messaging service, not a payment processor, so the sale also breaks the platform's own rules and the rules of any payment rail used to collect funds.
Telegram's rules and enforcement
Telegram's Terms of Service prohibit using the platform for illegal activity. The company publishes a transparency report and responds to valid legal requests. Channels that advertise card data get reported by users, by card issuers, and by fraud analysts. Removal of a channel does not end the matter. Account records, device identifiers, and payment trails can be subpoenaed.
How investigators find these channels
Card issuers run authorization checks on every transaction. A burst of declines on one card number points to a dump that has entered circulation. The Justice Department's Operation Boiling Point, announced in 2022, targets organized theft groups that use platforms such as Telegram. Cases have relied on undercover purchases, blockchain tracing, and shipping records.
What cardholders can do
- Set transaction alerts on every card.
- Use a virtual card number for online purchases.
- Review statements for small test charges.
- Report fraud to the issuer, then file a report at IdentityTheft.gov.
- Report online card crime to the FBI Internet Crime Complaint Center.
Under the Fair Credit Reporting Act and card network zero liability rules, a cardholder who reports unauthorized charges does not pay them. Reporting speed matters, because it stops further attempts on the same number.
What merchants and issuers do
PCI DSS v4.0.1 requires encryption of stored card data and limits what can be kept. Tokenization replaces the card number with a value that has no use outside one merchant. 3-D Secure asks the cardholder for a second factor at checkout, which blocks dumps that carry no cardholder access. These controls raise the cost of using stolen data, which lowers its resale price.
Bottom line
Selling CVV dumps on Telegram is a federal felony, not a gray market side job. The channel gets taken down, the records get subpoenaed, and the seller faces prison and restitution. Cardholders who find unauthorized charges should call the issuer and file a report.