Selling CVV numbers online is illegal. A CVV belongs to a live payment card account, so trading those numbers for cash counts as card fraud and identity theft under US federal law and the laws of most other countries. No legitimate marketplace exists where CVV data can be bought or sold.
This guide covers what the phrase means in fraud circles, which laws apply, and what cardholders and merchants can do to keep card data out of those markets.
Selling CVV Online: Top Withdrawal Methods
What does "sell CVV online" refer to?
In fraud circles, a "CVV" is not just the three digits on the back of a card. It is a bundle: card number, expiration date, security code, cardholder name, and billing address. Buyers call that package a "CVV" or a "fullz."
Most Popular CVV Online Marketplaces: A Comprehensive Guide
Sellers list these bundles on invite-only forums, chat channels, and dark web shops that take cryptocurrency. A listing often names the card's country, the issuing bank, and a claimed "valid rate," which is the seller's own number and cannot be checked before purchase.
- Card number and expiration date
- CVV2, CVC2, or CID security code
- Cardholder name and billing ZIP code
- Issuer name, and sometimes a phone number tied to the account
The card is not the seller's property. It belongs to the account holder and the issuing bank, which is why the trade is treated as theft rather than commerce.
Is selling CVV data a crime in the United States?
Yes. Federal prosecutors charge card data trafficking under 18 U.S.C. § 1029, which covers fraud tied to access devices, and under wire fraud statutes when a scheme crosses state lines or uses the internet.
Penalties for a first offense can include prison time and fines, and the exposure grows with the number of cards involved and the losses tied to them. State laws add their own charges for identity theft and possession of stolen financial records.
Buying is not safer than selling. A person who buys card data and uses it to order goods commits the same class of offense, plus fraud claims from the merchant and the bank.
How does stolen card data end up for sale?
Most card numbers reach these markets through breaches and trickery, not guesswork. Common paths include skimmers on fuel pumps and ATMs, phishing pages that copy a bank login, and malicious scripts injected into checkout pages on real stores.
Some comes from inside jobs at call centers and hotels, where an employee photographs a card or writes down the number. Social engineering calls, where someone poses as the bank's fraud team, also pull full card details from cardholders.
Chip cards, tokenization, and 3-D Secure checks have cut the value of stolen data. That is why card-not-present fraud stays the target: the CVV is one of the few checks an online store can run.
How do you protect your CVV?
If you hold the card
- Use virtual card numbers from your issuer for subscriptions and one-off purchases.
- Pay with a mobile wallet when you can. Apple Pay, Google Pay, and similar services send a token, not your real number.
- Turn on transaction alerts for every charge above a small amount.
- Never read your CVV aloud on a call you did not start, and never send it by email or chat.
- Skip storing card numbers in notes apps, spreadsheets, or browser autofill on shared devices.
- Freeze the card from your bank app when you are not using it.
If you run an online store
- Do not store the CVV after authorization. PCI DSS bans keeping sensitive authentication data once a transaction is approved.
- Tokenize card numbers so your systems never hold the real digits.
- Turn on 3-D Secure or an equivalent step-up check for risky orders.
- Watch for card testing. A burst of small charges or failed attempts points to a stolen batch being checked on your checkout.
What should you do if your card is used without permission?
- Freeze or cancel the card in your bank app or by phone.
- Dispute the charges in writing and keep the case number.
- Change the password on the bank account and any store account tied to the card.
- Report identity theft at IdentityTheft.gov if the fraud goes beyond one card.
- File a police report if your bank or insurer asks for one.
- Report the incident to the FBI's Internet Crime Complaint Center if you run a business and lost money.
FAQ
Is buying a CVV online ever legal?
No. A CVV is tied to someone else's account, so buying it is not a purchase of data in any legal sense. It is receiving stolen financial information.
Does a missing CVV stop a thief?
It helps for card-present transactions, where the chip or a PIN is checked. For online orders, the CVV is often the last check a merchant runs, so a thief who has it faces fewer blocks.
How fast does card fraud get caught?
It varies by bank and by how the card is used. Transaction alerts and a review of your statement are the fastest ways for you to spot a charge you did not make.
Where do you report a site that sells card data?
Report it to the FBI's Internet Crime Complaint Center and to the card issuer whose cards appear in the listing. Do not try to buy a card to "test" the listing. That is a crime on your side.
The short answer
Selling CVV data online is card fraud, and the market around it exists only because card numbers get stolen. Guard the code, watch your statements, and treat any offer to buy or sell card data as a crime in progress.