Short answer
No shop sells CVV numbers as a legal product. A CVV belongs to the cardholder who received the card. Anyone who offers to "sell CVV, no scam" is selling data taken from someone else, or is running a scam against the buyer. Both outcomes are fraud. In the US, buying or selling card data violates 18 U.S.C. § 1029, the access device statute. Penalties reach 15 years for a first offense.
The phrase "no scam" carries no guarantee. It appears on forums and Telegram channels that host the same stolen data. The label is a sales tactic, not a warranty.
How to Safely Sell CVV on a Shop in 2024
What a CVV is
The CVV is the security code printed on a payment card. Visa and Mastercard call it CVV2 or CVC2. It is 3 digits on the back. American Express prints a 4-digit code on the front. The code exists to prove the buyer holds the physical card during a card-not-present transaction.
PCI DSS Requirement 3.2 forbids merchants from storing the CVV after authorization. A real processor never keeps it. A "shop" that lists CVVs has data from a breach, a skimmer, or a phishing page, or it has invented the numbers.
How the "no scam" pitch works
- Fake escrow: The shop runs the escrow account, so the buyer has no recourse.
- Review farming: Positive posts come from accounts the seller controls.
- Test hits: Sellers offer a free sample to build trust. The sample is often a live card from a new victim.
- Deposit loss: Most buyers lose the deposit and never receive usable data.
- Buyer data harvest: Some shops collect the buyer's payment details and resell them.
Carding forums report high rates of buyer loss. The same accounts that complain about one shop promote the next one.
Legal exposure for buyers
Purchasing stolen card data is trafficking in unauthorized access devices. A conviction can bring fines and prison. Buyers also face civil suits from issuers and from cardholders. Banks charge back the loss and pass recovery costs to the merchant. A buyer who uses the data to make a purchase adds wire fraud and identity theft charges.
What actually protects a card online
- Use a virtual card number from your issuer for online merchants.
- Turn on transaction alerts for every charge above a set amount.
- Check the merchant's PCI compliance status before saving a card on file.
- Pay with a credit card, not a debit card. Credit cards limit liability at $50.
- Keep the CVV off any form that asks for it in an email or chat.
If your card data is exposed
Call the issuer and ask for a new card number. Review the last 90 days of statements. File a report at ReportFraud.ftc.gov and, for a data breach, at IC3.gov. Dispute charges in writing within 60 days of the statement date. The Fair Credit Billing Act gives you that window.
Merchants should never see a CVV after authorization. If a site asks you to send a photo of your card or the code by message, close the page.