Short answer
Selling a CVV is a crime in the US. No bank, payment processor, or marketplace runs a legal CVV sale. Listings that promise to "sell CVV immediately" sit on criminal channels, and most of them take the buyer's money and send nothing back.
What a CVV is
The CVV is the 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front and calls it the CID. The code is a check value. A merchant sends it with the card number and expiration date to confirm the physical card is in hand.
A card transaction uses four data points: card number, expiration date, cardholder name, and CVV. Card networks classify the CVV as sensitive authentication data.
Why there is no legal market
18 U.S.C. Section 1029 covers access devices. Card numbers and CVVs fall inside that category. Trafficking in access devices carries fines and prison terms up to 15 years. A sale that crosses state lines can also face wire fraud charges under 18 U.S.C. Section 1343.
Issuers void transactions that use stolen credentials. A buyer who pays for a CVV list has no recourse, because the payment itself is part of the offense. Civil claims fail for the same reason.
Why the offers are scams
The FBI Internet Crime Complaint Center logs card fraud complaints in large volume every year. Fraud forums sell "fresh" CVV lists that mix expired, test, and invented numbers. Common patterns:
- Sellers ask for cryptocurrency or gift cards. Both are hard to reverse.
- Sample CVVs sent as proof come from old breaches and are blocked by the issuer.
- Sellers vanish after the first payment, then ask for a "verification fee."
- Some listings are run by researchers or by law enforcement who log buyer details.
How card data is protected
PCI DSS Requirement 3.2 forbids storage of sensitive authentication data after authorization. That covers the CVV, the full magnetic stripe, and the PIN block. Merchants that need repeat billing use network tokens, which swap the card number for a value tied to one merchant.
No honest business holds a database of CVVs to sell. A seller who claims thousands of CVVs is lying or holding stolen data. Both cases end the same way for the buyer.
What to do if you see an offer
Report the listing to the FBI IC3 and the FTC. Include the platform, the account name, and the payment method requested. Do not send a test payment. Do not ask for a sample. Each step creates a record that ties you to the transaction.
How to protect your own CVV
- Type the code on each purchase. Do not save it in a browser or a notes app.
- Use a virtual card number for subscriptions when your bank offers one.
- Read statements for small test charges, often $1 or less.
- Freeze the card in your bank app when a charge looks wrong, then order a new card.
A CVV is a five-second input, not a stored asset. Treat any request to share it outside a checkout page as fraud.