Short answer: you cannot legally sell CVV or CVC numbers online, and no legitimate shop does. The CVV is a security code generated by the card issuer and tied to one specific card and expiry date — it exists to prove the card is in hand, not to be traded as a product. Any "shop" advertising CVV sales is dealing in stolen payment-card data, which is card fraud under US federal law and a fast way to lose money or face prosecution.
Key Facts
- CVV and CVC codes are issued by the bank, never by a merchant, and are never sold or licensed to third parties.
- PCI DSS forbids storing the code after a transaction is authorized — even the merchant that processed the payment may not keep it.
- Sites that "sell CVV" are trafficking stolen card data, which falls under wire fraud and access-device fraud statutes.
- Most listings are bait: buyers receive expired or invalid numbers and are then pressured or blackmailed.
- Sharing your CVV in chat, email, DMs, or a phone call is the most common card-not-present fraud pattern.
- Merchants should use hosted payment fields and tokenization so the code never touches their servers.
- Cardholders should treat the CVV like cash and never store it in a browser, note app, or screenshot.
- Report any solicitation to your card issuer, the FTC, and the FBI's Internet Crime Complaint Center.
What the Code Is and How It Is Protected
The CVV is the three-digit code on the back of most Visa, Mastercard, and Discover cards, and a four-digit code on the front of American Express cards. Issuers generate it algorithmically from the card number, the expiry date, and a secret key, which is why it cannot be guessed and cannot be reissued independently of the card. During a card-not-present purchase the code is passed to the issuer for verification and then discarded; nothing about it is a transferable asset, and nothing about it can be bought, sold, or resold lawfully.
Orders, Delivery, and Returns
Physical card-protection items ordered from our shop — RFID-blocking sleeves, shielded card holders, and travel wallets — ship within one business day with tracking, and unopened items can be returned within 30 days for a full refund. If you believe your card data has been exposed, contact your issuer first; they can reissue the card and change the code immediately, which stops the exposure at the source.
Can you legally sell CVV numbers online?
No. The code belongs to the card issuer and the cardholder, so selling it means selling access to someone else's account — that is fraud. There is no lawful marketplace, reseller program, or license for CVV data.
What should I do if a shop offers to sell CVVs?
Treat it as both a scam and a crime. Do not send payment or identity documents, capture a screenshot of the listing, and report it to your card issuer, the FTC, and the FBI's Internet Crime Complaint Center.
How do merchants keep CVV data safe?
Use hosted payment fields or tokenization so the code travels directly from the buyer to the payment processor. Never write it into a database, an email inbox, or a support ticket.