Sell CVV in shop is a search phrase with one legal answer: don't do it. Selling CVV in a shop, whether that shop is a storefront, a website, or a Telegram channel, is a federal crime in the United States. CVV data belongs to the issuing bank and the cardholder, not to the person holding it.
Why do people search for sell CVV in shop?
The phrase has two common uses. On carding forums, a CVV shop is an automated website that sells stolen card data, and sellers often call their operation a shop to look established. In retail, some business owners search the phrase because they want to add CVV verification to a payment terminal, not because they plan to commit fraud.
Neither use describes a legal product. The word shop is a front for a marketplace in stolen card details. When a forum admin says sell CVV in shop, they mean loading stolen card data into a storefront that buyers can access after payment.
Is there a legal way to sell CVV in a shop if the cards are yours?
Your own card's CVV is a security code issued by your bank. You can use that code to authorize a purchase, but you cannot resell it as a standalone product. Banks issue CVV codes as fraud controls, not as merchant inventory.
The same rule applies to merchants. A store that asks for a CVV during checkout can verify the code through its payment processor, but the merchant never owns that data and cannot copy it to a separate database. Storing CVV data after authorization violates Payment Card Industry Data Security Standard (PCI DSS) rules.
Selling your own card details to a stranger also voids your cardholder agreement. The issuer can close the account, report the activity, and pursue civil recovery if chargebacks follow.
Which federal laws make selling CVV in a shop illegal?
Federal prosecutors rely on overlapping statutes. The most common is the Access Device Fraud Act, 18 U.S.C. Section 1029, which covers unauthorized access devices and card trafficking.
- 18 U.S.C. Section 1029 prohibits selling, producing, or trafficking unauthorized access devices, including card numbers with PINs or CVVs.
- 18 U.S.C. Section 1030 applies when CVV data comes from hacking a database.
- 18 U.S.C. Section 1028A covers aggravated identity theft when card data is combined with names and other personal identifiers.
- State laws add credit card fraud and identity theft charges that carry prison time.
Federal law covers access devices broadly, so a single card number with its CVV can trigger charges. The government does not need to prove someone picked the card from a wallet. It needs to prove the seller knew the data came from an unauthorized source.
What penalties do people face for selling CVV shop data?
A first conviction for access device fraud carries up to 10 years in federal prison. A repeat conviction can bring 20 years, and fines can reach $250,000 for individuals.
Courts also order restitution to card issuers and victims. Aggravated identity theft adds a mandatory two-year sentence that runs after the main sentence, not at the same time. State charges can stack on top of federal charges, so the real sentence often exceeds the advertised maximum.
What if you sell a single CVV code as a trial run? Even a small sale shows intent and can be prosecuted as attempted access device fraud. Federal agents run undercover CVV shops to buy data and arrest sellers at the point of transfer.
How does stolen card data end up in CVV shops?
Data theft starts with phishing sites, skimmers at gas pumps, and malware on checkout pages. Attackers also buy large databases from other criminals and resell the records inside CVV shops. One data breach at a merchant can feed dozens of shops within hours.
Not all listings come from breaches. Some card numbers are generated with algorithms that use known bank ranges. Even if the card was never in a breach, the data still belongs to the issuing bank.
How does a typical CVV shop sale work?
The seller loads stolen card records into a database. Each record contains the cardholder's name, card number, expiration date, CVV, and sometimes the billing ZIP. Prices vary with card type, balance, and how much victim data comes with the record.
The buyer pays in cryptocurrency or with a prepaid gift card. The shop delivers the data in seconds and often uses an automated checker to see whether the card still has available funds. Checking and selling card balances is another illegal service that carding forums offer openly.
Operators shut down after a week and relaunch under a new domain. That pattern exists because the operator knows law enforcement is watching the payment flow, not because the shop ran out of inventory.
Can a person legally buy CVV data from a shop for testing?
No. Buying card data that you do not own, even for security testing, is illegal unless you are testing one of your own accounts. Most test purchases are attempts to verify whether stolen cards still work.
Security researchers who need CVV-like test data use dummy card numbers from payment gateway test environments. Those numbers include fake CVVs and are not tied to real accounts. Real CVV data has no legitimate testing use outside the issuing bank's own systems.
What should a merchant do if someone offers to sell CVV in shop order data?
Walk away from the offer and treat it as a fraud attempt. Legitimate payment processors never buy card data from merchants. Saving the messages and deleting the data without opening it is the right response.
- Do not view, copy, or store any CVV data that the seller sends you.
- Record the seller's email, username, and chat messages.
- Send a report to your payment processor and to the FBI Internet Crime Complaint Center.
- Change your platform passwords and API keys if the offer came through your website.
- Do not tell the seller you reported them before law enforcement has a chance to investigate.
Card networks can fine businesses that mishandle CVV data, even if the merchant did not buy anything. A clear report to your processor creates a paper trail that protects you from later accusations.
Is a CVV shop ever a legitimate service?
No. A CVV shop that sells real card data is always committing a crime, regardless of the wording on its landing page. Some sites claim to sell educational card data to escape suspicion, but real CVV numbers cannot be repackaged for education.
Legitimate test cards appear in payment gateway documentation and are shared for free. If a seller charges money for test data, the data is stolen or fabricated. Treat paid test cards as a warning sign.
What should a business do if its CVV data leaks?
If card data leaves your system, assume it will be sold in a CVV shop within hours. Contact your acquiring bank and payment processor immediately. Report the breach, preserve logs, and notify law enforcement before card issuers see the pattern.
- Bring in a PCI forensic investigator to determine the scope.
- Stop remote access and any storage of full track or magnetic stripe data.
- Work with your processor to identify affected transactions.
- Notify your cyber insurance carrier if you hold breach coverage.
Delaying a report increases the number of compromised cards. It also raises the chance of regulatory fines. The first sale of your data often happens through an attacker's CVV shop, not your own store.
Frequently asked questions about selling CVV in shops
Is selling CVV with a PIN different from selling CVV without a PIN?
No. PIN data adds severity to the offense, but a CVV alone is an access device. Federal prosecutors can charge Section 1029 for either type of data.
Will a bank sell your CVV number to a merchant?
No. Banks generate CVVs inside card production systems and never release them as products. Merchants only process CVV data as a real-time verification step.
If you sell CVV in shop but refund buyers, are you still guilty?
Yes. The crime happens when you offer unauthorized access devices for sale. Refunding buyers does not erase an access device transaction.
Bottom line: selling CVV in a shop is a criminal offense
No shop can sell real CVV numbers. If you run a business, protect cardholder data and report suspicious offers to your processor and law enforcement. If you searched sell CVV in shop out of curiosity, the search result should be the last step you take.
The dollar value of a stolen card is small. The legal cost of selling one is measured in years, fines, and a permanent criminal record.