The short answer

Selling CVV or CVC numbers online is a federal crime in the United States. There is no legal market for card verification values. The code exists to prove that a person holds the physical card. A seller who offers codes is trading in stolen access devices. Under 18 U.S.C. 1029, a conviction can bring a fine and up to 10 years in prison. A prior conviction or a large operation raises the maximum to 15 years.

want to sell cvv reddit

Payment networks, banks, and card issuers do not buy CVV data from third parties. A site or chat channel that advertises CVV sales is selling stolen records, selling test numbers that fail, or running an advance-fee scam against the buyer.

i want to sell cvv

What a CVV is

Visa, Mastercard, and Discover print a 3-digit code on the back of the card. American Express prints a 4-digit code on the front. The networks call it CVV2, CVC2, or CID. It is not the card number and it is not the PIN.

read more

Card networks require the code for card-not-present transactions. Online merchants send the number, the expiration date, and the code. The issuer checks the value and returns an approval or a decline.

CVV/CVC Security for Online Purchases: How to Stay Safe

Why the code has no resale value

PCI DSS bars merchants from storing the code after an authorization. Requirement 3.3.1 in PCI DSS v4.0 lists the CVV as sensitive authentication data. A database that keeps it fails an assessment. That rule cuts the supply at the source.

A stolen code is good for one transaction on one account, and the card holder can dispute the charge. Issuers add velocity checks, device fingerprints, and address verification. A matching card number and code still gets declined when the billing address, IP address, or shipping address does not match the account history.

Where stolen card data comes from

  • Skimming devices on gas pumps, ATMs, and point-of-sale terminals. The FBI has warned about skimmers at fuel stations for years.
  • Data breaches at merchants and processors that handle card numbers.
  • Phishing pages that copy a checkout screen and collect the number, the code, and the ZIP.
  • Malware that reads a saved card profile on a home computer.

Full packages, called fullz on criminal forums, add the card holder name, address, Social Security number, and date of birth. Asking prices run from $1 to $50 per record, based on the account balance and the issuing bank.

Penalties

18 U.S.C. 1029 covers the production, sale, and possession of access devices. Sentences rise with the number of cards and the dollar loss. State laws add charges for identity theft and computer crimes. Banks can also sue for losses after a criminal case ends.

How to protect your card

  • Use a virtual card number for online purchases when the issuer offers one.
  • Turn on transaction alerts in the bank app.
  • Check the reader and the keypad before you pay at a pump.
  • Keep the CVV off notes, photos, and cloud files.
  • Buy only on sites with a padlock and a known domain.

If your card number leaks

  1. Call the issuer and ask for a freeze or a new number.
  2. Review statements for charges you do not recognize.
  3. Dispute the charges in writing. Under the Fair Credit Billing Act, credit card liability for unauthorized use is capped at $50, and most issuers set it at $0.
  4. Report identity theft at IdentityTheft.gov if your SSN or other data was exposed.
  5. File a complaint with the FBI Internet Crime Complaint Center.