There is no legitimate way to sell CVV data online. In the United States that trade is access device fraud, and the search that leads to it ends in federal charges far more often than it ends in profit. The practical answer for merchants and shoppers is the reverse of the query: how to keep card security codes from being abused. The top pick is CVV verification enforced at authorization, paired with address verification and EMV 3-D Secure, because that stack stops stolen card data from turning into shipped goods. Three narrower options follow: network tokenization, AVS plus velocity rules, and step-up authentication for high-risk orders.
Why Selling CVV Data Fails as a Business
US law treats card numbers, expiration dates, and CVV or CVC codes as access devices. Trafficking in them is charged as a felony, and the penalties scale with volume and dollar value. Beyond the legal exposure, the market itself is hostile to sellers and buyers alike. Card issuers retire compromised numbers quickly, networks score and block known fraud patterns, and forums that host this trade are dense with exit scams where one party takes payment or data and disappears. Anyone who receives an offer to buy or sell CVV data should treat it as evidence of a crime, not an opportunity.
Top Pick: CVV Verification at Authorization
Requiring the printed security code on every card not present transaction is the single highest-value control for most merchants. The code is not stored with the account number, so a leaked database alone does not produce a working transaction. Processors return a match, no match, or unavailable response that you can route into your decision logic.
- Pros: low cost, supported by every major processor, catches bulk card testing within minutes, and matches what the card networks expect for card not present liability.
- Cons: fails when the cardholder volunteers the code to a scammer, does not stop account takeover where the attacker has full card data, and cannot be stored for later reuse under PCI DSS.
Use it as your default for physical goods sold to US addresses, where shipping gives you a second layer of verification.
How to Sell CVV Effectively: A Comprehensive Guide
Option 2: EMV 3-D Secure
3DS asks the issuing bank to authenticate the cardholder in the background and steps up to a challenge only when risk is high. Liability for certain fraud chargebacks shifts to the issuer when authentication succeeds.
- Pros: meaningful liability shift, strong protection on digital goods and high-ticket items, and invisible for most low-risk shoppers.
- Cons: adds integration work, can introduce friction and false declines, and coverage varies by issuer and region.
Use it for digital downloads, gift cards, and any order value where a chargeback would erase the margin.
Option 3: Network Tokenization
Tokenization replaces the account number with a token that is useless if intercepted, and it keeps working across recurring payments and wallets.
- Pros: shrinks your stored data footprint, survives card reissuance, and reduces PCI DSS scope.
- Cons: it is not a fraud check by itself, requires a token service provider, and adds reconciliation work for refunds and disputes.
Use it for subscriptions and card on file billing, where the same credential is reused many times.
Option 4: AVS With Velocity and Device Rules
Address Verification Service compares the billing street and postal code against issuer records, while velocity rules flag one device or IP hitting many cards.
- Pros: inexpensive, catches enumeration attacks, and pairs well with CVV results to build a risk score.
- Cons: partial matches create false positives, and AVS support is uneven outside the US and Canada.
Use it as a safety net for small catalogs and manual review queues.
If Someone Offers to Sell You CVV Data
- Do not send payment or personal details, and preserve the messages.
- Report the contact to the FBI Internet Crime Complaint Center.
- If your own card data was exposed, file a report and recovery plan through the FTC, then call your issuer.
- Merchants should log the attempt with their acquirer and fraud team so the pattern can be blocked.
Choosing by Use Case
- Physical goods, US shipping: CVV verification plus AVS.
- Digital goods and high order values: CVV verification plus 3DS.
- Subscriptions and card on file: network tokenization plus CVV at first authorization.
- Small catalog with manual review: AVS and velocity rules with CVV results as the primary signal.