Selling CVV numbers online is a federal crime in the United States, not a gray market and not a side business. The three or four digit code printed on a payment card exists to prove that the physical card is in hand, and buying or selling that code without the cardholder's consent falls under laws written to punish trafficking in stolen account data. The sections below explain what the phrase covers, which statutes apply, and how cardholders and merchants keep CVV data out of criminal hands.

make money selling cvv online

What "sell CVV online" actually refers to

The phrase describes a corner of the cybercrime economy where stolen card details are packaged and traded. Sellers work through invite-only forums, messaging channels, and automated storefronts. Listings often bundle the card number, expiration date, cardholder name, and billing address with the CVV, a package criminals call a fullz. Prices scale with the card's credit limit and the issuer's country. None of this is a legitimate product category. Every listing depends on data taken from a person who never agreed to the sale.

best sites to sell cvv online

Which US laws apply

Several federal statutes reach this conduct at once. 18 U.S.C. § 1029 targets trafficking in unauthorized access devices and carries penalties that climb with the value of the fraud. 18 U.S.C. § 1028 covers identity documents and authentication features. 18 U.S.C. § 1343 applies when the scheme crosses state lines, which any online sale does. State statutes add their own charges for theft, forgery, and computer crime. Both sides of the transaction carry liability: the seller who offers the data and the buyer who uses it. Routing traffic through a proxy or paying in cryptocurrency does not change the analysis, and payment trails are a routine part of these investigations.

Most Popular CVV Online Marketplaces: A Comprehensive Guide

How a stolen CVV becomes card-not-present fraud

Card data leaves a cardholder's control through skimmers on fuel pumps and terminals, phishing pages that mimic a checkout, malware on a merchant's network, or a breach at a processor. The stolen records are then sorted, tested with small purchases, and resold. A working CVV lets a criminal place orders by phone or web where no card is swiped. The merchant ships goods, the real cardholder disputes the charge, and the merchant absorbs the loss along with chargeback fees.

read more

Protect your CVV during online purchases

  1. Type the card number and code yourself. Never read the CVV aloud in public, email it, or send it through a text message.
  2. Let your bank or wallet app store the card with tokenization instead of saving it in a browser on a shared or public device.
  3. Request a virtual card number from your issuer for subscriptions and for shops you have not bought from before.
  4. Cover the back of the card with your hand at a terminal and keep the card in view during every in-person transaction.
  5. Confirm the checkout page uses an encrypted connection and that the merchant name matches the site you intended to visit.
  6. Review card activity once a week in the issuer's app rather than waiting for a monthly statement.
  7. Freeze the card in the issuer's app the moment it goes missing, then order a replacement.

Warning signs your card data is being traded

  • Small charges of a dollar or less from merchants you do not recognize, which are often test authorizations.
  • A replacement card arrives that you never requested.
  • A breach notice from a retailer where you have an account with a saved card.
  • Bank mail stops arriving at your address or a change of address notice appears.

If you think your CVV was compromised

  1. Freeze the card in the issuer's app to stop new authorizations.
  2. Call the number on the back of the card and ask for a new card number, expiration date, and CVV.
  3. Dispute each unauthorized charge in writing within 60 days of the statement date, the window set by the Fair Credit Billing Act.
  4. Change the password on every shopping account that stored the card and turn on multi-factor authentication.
  5. File a report at IdentityTheft.gov and keep the confirmation number for your records.

For merchants: keep CVV out of storage

  • Delete the CVV after authorization. PCI DSS forbids storing it in any form after the transaction is approved.
  • Replace stored card numbers with tokens from your payment processor.
  • Treat a CVV mismatch as one fraud signal among several, alongside address verification and velocity checks.
  • Train staff never to write card numbers or codes on paper, and audit any place they might.