You cannot sell CVVs to a shop online. A CVV is the 3 or 4 digit security code on a payment card, and trading it is card fraud under US federal law (18 U.S.C. § 1029). Sites that offer to buy codes are scams, data traps, or police operations, and no legal version of that market exists.
What does "selling a CVV" mean in practice?
In carding slang, a CVV listing is a bundle: card number, expiration date, cardholder name, and the security code. Sellers push these bundles through dark web markets, Telegram groups, and invite-only forums, priced by the victim's country, card brand, and bank. The whole chain, from stealing to listing to cashing out, is one crime split into steps.
CVV Shop Reseller Options: A Comprehensive Guide
Buyers use the data to order goods, load gift cards, or check which cards still work. That last step, card testing, hits small merchants with thousands of small charges in a few hours.
Is it legal to sell CVV numbers in the US?
No. Federal prosecutors charge card-data trafficking under 18 U.S.C. § 1029, which covers producing, selling, and possessing unauthorized access devices. Penalties reach 10 years for a basic offense and 15 years when the case involves multiple devices or more than $1,000 in value in a single year.
Sending CVV to Shops for Payment: A Buying Guide
- Federal charges: prison time plus fines, and the court can order restitution to banks and cardholders.
- State charges: most states add their own identity theft and fraud statutes on top of the federal case.
- Card network rules: card brands ban the storage and trade of CVV data, so any merchant caught handling it loses processing rights.
- Civil suits: victims and issuing banks can sue for losses, which often lands on the person who sold the data.
Do "CVV shops" that buy codes exist?
Not as real businesses. A shop that advertises "we buy CVV" has no legal way to use the data, so the offer is bait. Some sites take a deposit and vanish. Others log your IP address, browser fingerprint, and wallet details to build a profile they can sell or use for extortion.
- Payment demanded in crypto before any "inspection" of the data.
- Escrow accounts run by the same people as the shop.
- Free sample lists that harvest your contact details.
- Chat channels that ask for a photo ID to "verify" you.
How does card data get stolen before it reaches a shop?
Most stolen CVVs come from a small set of repeat methods, and none of them require technical skill.
- Skimmers: hardware planted on fuel pumps, ATMs, and card readers.
- Phishing: fake checkout pages and delivery notices that copy a real store's design.
- Breaches: merchant systems that stored more data than they needed.
- Social engineering: calls or texts that ask a cardholder to "read the code on the back."
- Mule recruiting: offers to "rent" someone's card or account for a cut of the proceeds.
How do merchants keep CVV data away from criminals?
Card security rules exist to make CVV data useless after a single transaction. PCI DSS forbids storing the code, even in an encrypted form, once authorization finishes.
- Use tokenization so the checkout page never touches raw card numbers.
- Turn on 3-D Secure or another step-up check for high-risk orders.
- Compare the billing address and the card code at authorization, then block mismatches.
- Set velocity limits so a stolen card cannot be tested across dozens of small orders.
- Screen devices and IP ranges tied to known card-testing patterns.
What should you do if someone asks you to sell card data?
Refuse, stop replying, and keep the messages. A request to sell or supply a CVV is a request to join a fraud chain, and the person asking is often already under investigation.
- Do not send a "sample" code or card photo, even as a test.
- Report the contact to the FBI Internet Crime Complaint Center and the FTC.
- Call the number on the back of your card if your own details were shared.
- Contact your payment processor or acquirer if you run a store and see card-testing traffic.
What legal work involves card data and fraud?
Payments security is a real field with steady demand, and it pays for the same knowledge that fraud rings misuse. Common roles include fraud analyst, chargeback and dispute specialist, PCI compliance analyst, and payments risk engineer. Analysts read transaction patterns, flag card-testing bursts, and write rules that stop stolen cards at checkout.
Can I sell the CVV of my own card?
No. There is no legal buyer, and handing your code to a stranger lets that person spend your money. Offers to "rent" your card for a percentage are money-mule or laundering setups, and you carry the loss plus the liability.
How do I protect my CVV when I shop online?
Treat the code like cash and share it with no one except a checkout page you trust.
- Type the code only on a checkout page with HTTPS and a domain you recognize.
- Never send it by email, text, chat, or social media, and never to a "seller" who asks for it.
- Use virtual card numbers from your bank for subscriptions and unfamiliar stores.
- Check statements each week, and freeze the card at the first charge you do not recognize.
The short version: there is no shop to sell a CVV to, and the only people who profit from that search are the ones running the scam. If your goal is to work with card security, the legal path runs through fraud analysis and payments compliance, not a marketplace.