There is no legal market that sells CVV codes for PayPal or any other payment method. A CVV is a security code tied to a card account, and buying or selling one is access device fraud under 18 U.S.C. § 1029. The sites that advertise "CVV for PayPal" are scams that take payment and hand over stolen or dead card data.
What does "sell CVV online for PayPal" mean in practice?
Sellers in these ads claim to deliver card numbers, expiry dates, and CVV codes that clear on PayPal checkout. The pitch borrows PayPal's name to look trustworthy. No one but the cardholder holds a valid CVV, and cardholders do not sell them.
- CVV / CVV2 / CVC2: the 3 or 4 digit code printed on the card, used to prove the physical card is on hand.
- Card-not-present fraud: the category that covers stolen card data used in online checkout.
- Carding: the slang for testing and reselling stolen card numbers, which is a federal crime.
Why are CVV shop websites scams?
These sites run on one pattern. A new domain appears, sells "fresh" lists, takes crypto or gift cards, then vanishes in weeks. Buyers have no recourse because the deal itself is illegal.
Much of the data is recycled. Sellers test old card numbers on small merchants to see which still authorize, then resell the survivors to many buyers. The card gets shut down after the first few charges.
- No escrow, no refunds, no support that survives a domain change.
- Fake vouches and screenshots that anyone can produce in minutes.
- Lists padded with numbers built from public BIN ranges that never authorize.
- Some shops log buyer details and resell those too.
What are the penalties for buying or selling card data?
18 U.S.C. § 1029 covers access device fraud. A first offense carries up to 10 years in prison, and up to 15 years when the case involves 15 or more devices or $1,000 or more in a one-year period. Restitution and fines stack on top.
Using stolen card data on PayPal adds exposure. Account takeover and unauthorized access fall under computer fraud statutes, and PayPal freezes accounts tied to fraud rings and reports them.
How does a CVV protect payments?
The CVV links a card to the physical plastic. A thief who photographs the card front still lacks the code, so many online merchants decline the charge. That is the whole design: one extra field that a stolen data dump often misses.
What merchants may and may not do with a CVV
PCI DSS Requirement 3.2 forbids storing sensitive authentication data after authorization. That covers the CVV2, the full magnetic stripe, and the PIN block. Keeping the code "for convenience" breaks the standard and turns any breach into a liability.
- Send the CVV to the processor during authorization, then discard it.
- Never write it to a database, log file, order note, or email.
- Never ask a customer to send a CVV by chat, text, or email.
- Mask card numbers in every screen and export.
How do you spot a CVV scam offer?
Treat any message that offers card data as hostile. Banks, processors, and fintech firms never sell card numbers, and no vendor needs your customers' CVVs to "verify" anything.
- Unsolicited contact on Telegram, Discord, or forum DMs.
- Prices quoted per card or per "fullz" bundle.
- Pressure to pay in crypto or gift cards.
- Claims of a private base with proof screenshots.
- Requests for your own card details to "test" the batch.
What should you do if someone offers to sell you CVV data?
Do not reply, do not send money, and keep the messages. Report the contact to the FBI's Internet Crime Complaint Center and to the FTC at ReportFraud.ftc.gov. If the offer names a specific bank, tell that bank's fraud line as well.
If your own card data shows up in an offer, call the issuer and ask for a replacement card with a new number and CVV. Scan recent statements for small test charges of a dollar or less.
FAQ
Is there a legitimate business that buys CVV codes?
No. Card networks and processors verify codes through authorization messages, not by trading them. A company that claims to buy CVVs is either a scam or a front for fraud.
Does PayPal check CVV codes?
When a buyer pays with a card through PayPal, the code goes to the card issuer for verification during authorization. PayPal balance and bank transfers use no CVV at all, so an offer for a "PayPal CVV" describes something that does not exist.
Can I sell my own card's CVV?
No. Cardholder agreements ban sharing card credentials with third parties, and issuers void fraud protection on transactions where the cardholder handed over the data. You would also be giving a stranger access to your account.
What happens to a store hit by card testing?
The store pays chargebacks and fees, risks losing processor access, and may land in a fraud monitoring program. Card testing traffic also burns server capacity. Rate limits, address verification, and CVV checks cut it down.
Why do scammers use PayPal in their ads?
PayPal is a familiar brand, so the name lowers a buyer's guard. The brand has no role in the deal. The scam runs on chat apps and crypto payments.