Short answer
"Sell CVV on shop" is a phrase from criminal card markets. It describes the sale of stolen card numbers with the card verification value attached. No legal business sells CVV data. In the United States, trafficking in card numbers is a federal felony under 18 U.S.C. § 1029. The venues that advertise this service sit on hidden forums, Telegram channels, and Tor sites.
What a CVV is
Visa prints CVV2. Mastercard prints CVC2. American Express prints CID. The code is 3 digits on most cards and 4 on American Express. It sits on the card face, outside the magnetic stripe and outside the chip. Merchants ask for it on card-not-present orders: phone, mail, and online sales.
What these shops list
Listings pair a card number with an expiry date, a cardholder name, and the CVV. Some add billing address, phone number, email, and Social Security digits. That larger bundle gets called a "fullz" or a "full." Prices run from about $1 for a random card to $50 and up for a card with a high credit line and matching identity data. Payment moves through crypto. Escrow is rare. Sellers use automated checkers to test which numbers still authorize.
Selling CVV on a Shop with Bitcoin: A Comprehensive Guide
Why online card fraud grew
US merchants moved to EMV chip cards after the 2015 liability shift. Counterfeit cards at the terminal became harder to pass. Stolen numbers moved to the web, where the chip does nothing. The Federal Trade Commission reported $12.5 billion in consumer fraud losses for 2024.
The legal position
Section 1029 of Title 18 covers access device fraud. Selling, buying, or holding card numbers with intent to defraud carries prison time and fines. Penalties reach 15 years for trafficking offenses. Federal agents have taken down shops and their operators. In 2023 a federal court in Brooklyn sentenced the operator of the card-checking service Try2Check to 5 years in prison.
Controls that reduce exposure
- PCI DSS bars storage of the CVV after a transaction authorizes. That is Requirement 3.3.1 in version 4.0.
- Tokenization swaps the card number for a token tied to one merchant or one device.
- 3-D Secure adds an issuer check at checkout. Visa Secure and Mastercard Identity Check use it.
- Address verification compares the billing address on file with the address a buyer submits.
- Cardholders can freeze accounts, set transaction alerts, and use single-use virtual numbers.
Participants lose on both sides
Buyers of stolen data face the same statute as sellers. Card issuers cancel compromised numbers, so a purchased card may fail within hours. Some listings are outright fraud: the seller takes crypto and delivers a canceled card or a number from a bank honeypot. Personal data handed to a shop operator stays with that operator.
Bottom line
No legitimate shop sells CVVs. The phrase points to card fraud, and the conduct is illegal in the US and most other countries. Merchants cut risk through PCI DSS scope reduction, tokenization, and 3-D Secure. Cardholders cut risk with alerts, freezes, and virtual card numbers.