Answer first
There is no legal way to sell CVV data on a carding site. A carding site is a criminal marketplace for stolen payment card numbers. Selling, buying, or holding that data for use is a federal offense in the US under 18 U.S.C. § 1029 and related wire fraud statutes. The CVV is a security feature built to stop exactly this trade. This guide covers what those sites are, why the CVV exists, and what merchants and shoppers do to block the fraud.
What a carding site is
A carding site is a forum or storefront that trades stolen card data. Listings typically bundle a card number, expiry date, cardholder name, and address. The CVV or CVC is the three or four digit code printed on the card. Carding sites operate as illegal businesses. Law enforcement agencies run takedowns against them and prosecute operators and sellers.
Why the CVV exists
The CVV proves the person entering the number holds the physical card. Card networks require it for card-not-present transactions. Stolen card numbers without the CVV fail at checkout. That single field is the main reason card data sold without a CVV has little value.
What happens to card data on those sites
- Data gets resold many times. The same card number can appear in multiple listings.
- Banks cancel compromised cards. Buyers who pay for a listing often receive a dead number.
- Sellers get identified through payment trails, chat logs, and infrastructure. Prosecutions follow.
- Cardholders dispute charges. Merchants absorb chargebacks and lose the goods.
Protection for merchants
- Do not store the CVV after authorization. PCI DSS Requirement 3.2 prohibits retaining sensitive authentication data.
- Require the CVV on every card-not-present order and send it for verification.
- Use AVS checks on the billing address and street number.
- Apply 3-D Secure for high-risk orders and new accounts.
- Tokenize card numbers so your systems never hold the full primary account number.
- Screen orders for mismatch between billing country, IP address, and shipping address.
Protection for shoppers
- Use a credit card for online purchases. Credit cards limit your liability for fraud.
- Check the checkout page address bar and the padlock before you type the CVV.
- Never send card details by email, text, or chat.
- Review statements each month and report unknown charges to the issuer.
Legal position
Selling stolen card data carries prison terms and fines in the US. Possession with intent to use is also chargeable. Victims can report card fraud to the FTC and to the FBI's Internet Crime Complaint Center.