Short answer
No legitimate shop sells CVV or CVC codes. The CVV is the 3 or 4 digit code on a payment card. It ties the card number to the physical card. A sale that moves the code to a stranger breaks that tie and becomes card-not-present fraud. Reddit's content policy bans transactions in stolen property and in illegal services. Threads that offer card data get removed, and the accounts behind them get suspended.
What the shop posts are
Most posts with the phrase sell CVV follow one pattern. A new account, a handle on a chat app, a price list by card brand, and a demand for crypto payment before delivery. The buyer sends funds and gets no data, or gets 16 digit numbers that fail at checkout. The poster holds no card data and runs no shop.
A second pattern is a fake storefront. The page copies a real checkout layout, then asks the buyer to log in or to pay a verification fee. It collects credentials and card details from the buyer.
Legal status in the US
18 U.S.C. § 1029 covers access devices. Courts treat card numbers and CVV codes as access devices. A trafficking conviction under that section carries up to 15 years in federal prison. State statutes add charges on top. Issuers and merchants can sue for losses, and each disputed charge returns as a chargeback against the merchant account that accepted the card.
Selling CVV on a Shop with Bitcoin: A Comprehensive Guide
Why a purchased code fails
- Issuers cancel and reissue cards after a breach. Lists age fast.
- 3-D Secure prompts the cardholder for a second factor on many card-not-present orders.
- Sellers resell one list to many buyers. The first failed attempt flags the card.
- Address verification and CVV mismatch rules decline the charge at the gateway.
What merchants should do
PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. The CVV is in that set. Keep it out of logs, order notes, and databases. Tokenize the card number at the gateway. Ask for the CVV on each card-not-present order and set the gateway to decline on a mismatch. Add 3-D Secure for high-risk orders. That step moves chargeback liability to the issuer in covered cases.
Reporting
Card data sales are federal crimes in the US. Report them to the FBI Internet Crime Complaint Center and to the FTC. Report the post to Reddit through the in-app report flow. Report the card to the issuer if your own number appears in a listing.