"Sell CVV for bitcoin" names a crime, not a service. The phrase describes the trade of stolen payment card data for cryptocurrency. United States law treats the sale as access device fraud under 18 U.S.C. § 1029. No legal market exists for CVV data.
What the phrase covers
A CVV is the 3 or 4 digit code printed on a payment card. It is not written to the magnetic stripe and not stored on the chip. The code exists to show that the person submitting a card number holds the physical card.
In fraud listings, "CVV" is shorthand for a bundle: card number, expiration date, cardholder name, and the verification code. Sellers add billing address, phone number, or government identifiers and label the bundle "fullz." Buyers pay in bitcoin or another crypto asset. The listing is stolen inventory, and the seller does not own the accounts.
Why the code exists
Card networks require CVV entry for card-not-present orders. The check ties a transaction to the card itself, not to a leaked number. PCI DSS requirement 3.2 bars merchants from storing sensitive authentication data, including the CVV, after a transaction is authorized. That rule limits the value of a stolen database and is one reason fraud sellers market single-card records instead of bulk files.
Legal exposure
- 18 U.S.C. § 1029 covers producing, selling, transferring, and possessing access devices with intent to defraud. A first offense carries up to 10 years. Offenses involving 10 or more devices carry up to 15 years.
- 18 U.S.C. § 1343 covers wire fraud committed through the internet and messaging channels used to arrange a sale. Penalties run to 20 years.
- Money laundering statutes cover the bitcoin leg when proceeds move through exchanges, mixers, or third-party wallets.
The bitcoin leg leaves records
Bitcoin records every transfer on a public ledger. Chain analysis firms group addresses into clusters and tie clusters to exchange deposit accounts. US exchanges operate under Bank Secrecy Act rules: identity verification, transaction monitoring, and suspicious activity reports filed with FinCEN. A payment routed through a regulated exchange creates a documented trail from wallet to account holder. Prosecutors have used ledger evidence in carding cases.
Buyer-side risk
Sites that advertise CVV sales are a known vector for exit scams and fake escrow. Buyers send bitcoin and receive nothing, or receive data that card issuers have already canceled. Issuers reverse unauthorized charges, so stolen card records have a short useful life. Buyers have no recourse and no legal channel for a refund.
Controls that block the trade
- CVV verification on every card-not-present order.
- Address verification service checks against the issuer's records.
- 3-D Secure authentication for higher-risk transactions.
- Tokenization, so card numbers never reach merchant servers.
- Cardholder freezes through the issuer app and single-use virtual card numbers.
Reporting
Cardholders report unauthorized charges to the card issuer, then file a complaint with the Federal Trade Commission and the FBI Internet Crime Complaint Center. Merchants report card-not-present fraud to their acquiring bank and to the card network. Reports that include wallet addresses and timestamps help investigators connect a case to existing ledger records.