Short answer
There is no legal marketplace where you sell CVV codes online, with or without fees. A CVV is a security code tied to someone's payment card, and it exists to prove the cardholder is present. Selling it means selling access to another person's money. Every listing you find advertising "CVV for sale, no fees" is either a scam aimed at you or a criminal storefront moving stolen card data. Both are bad news for anyone who touches them.
If you arrived here looking for a cheap way to buy card data, the honest answer is that the search ends in fraud charges or an empty crypto wallet. If you run an online store and want to stop this traffic, the rest of this guide is for you.
What a CVV actually is
Three names get used for the same idea. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID. On most cards it is the three digit code on the back, or four digits on the front for Amex. It is printed, not embossed, and it is not stored on the magnetic stripe or the chip.
That design matters. A thief who skims a stripe gets the card number and expiry but not the code. The CVV is the piece that forces an attacker to have the physical card in hand. That is why card networks treat it as sensitive authentication data rather than ordinary account information.
Why the CVV cannot be sold or stored
PCI DSS Requirement 3.2 forbids keeping sensitive authentication data after authorization. That includes the full track data, the PIN block, and the card verification code. A merchant that keeps CVVs in a database after a transaction is out of compliance, and a breach of that database hands attackers everything they need in one file.
So the "no fees" pitch is a tell, not a feature. Real payment processors charge interchange and gateway fees because moving money costs money. A seller who claims zero fees is not running a payment business. They are running a scam, a phishing trap, or a carding shop.
What those sites are usually doing
- Taking your deposit and disappearing. The "free CVV samples" are bait to get you to fund an account.
- Logging your IP, browser fingerprint, and crypto address to build a target list for extortion.
- Delivering dead card numbers harvested months ago that will decline on the first try.
- Running a law enforcement sting or a research honeypot.
None of those outcomes end well for the buyer. Carding forums are full of people who paid in and got nothing back, and they have no recourse because the transaction was never legal.
What merchants should check on every order
When I review a checkout flow, I look for four things. First, is the CVV actually being collected and sent to the processor, or is it being skipped to reduce friction? Skipping it raises fraud losses far more than it lifts conversion. Second, is the code stored anywhere after authorization? It should not appear in logs, order notes, support tickets, or analytics events. Third, is Address Verification Service running alongside the CVV check? The two together catch more fraud than either alone. Fourth, is 3D Secure enabled for high risk segments like new accounts, large carts, and cross border shipping addresses?
Practical hardening steps
- Tokenize card data so your systems never hold a reusable number.
- Mask the CVV field in all internal tools and block it from session replay scripts.
- Set velocity rules on card testing patterns: many small orders, same IP, rapid retries.
- Train support staff never to ask a customer for the full code over chat or email.
What cardholders should do
Never send your CVV through email, text, or a chat window. A legitimate merchant asks for it only inside a secure checkout page. If a caller claims to be from your bank and wants the code, hang up and dial the number on the back of your card. Report unauthorized charges to your issuer right away, and file a complaint with the FTC or the FBI's Internet Crime Complaint Center if you believe your data was sold.
The short version: the CVV is a lock, not a product. Treat any offer to sell it as a warning sign.