Short answer
No legal market exists for CVV data. A portal that sells CVV numbers is a criminal shop. Selling or buying card data violates 18 U.S.C. § 1029 in the United States and similar statutes in most other countries. Federal access device fraud carries up to 15 years per count. Punishments rise when prosecutors add wire fraud, identity theft, or money laundering charges. Portals that promise CVV sales are also a routine scam. The buyer pays and gets nothing, gets a test number that fails, or gets a visit from law enforcement.
How to Get Paid Selling CVV on Carding Sites: A Comprehensive Guide
Terms
- CVV / CVC: the 3 or 4 digit code printed on a payment card. Card-not-present checks compare the code the buyer types with the issuer record.
- Carding: use of stolen card data to buy goods or move funds.
- Carding portal: an online storefront that lists card records for sale, run on Tor or on a compromised domain.
- Dumps: track data read from a card magnetic stripe.
- Fullz: a record that bundles card data with name, address, phone, or government ID number.
Legal exposure for a seller
Section 1029(a)(3) covers the sale or transfer of an access device. Section 1029(a)(2) covers trafficking in access devices obtained without authorization. A card number plus its CVV fits the definition of an access device. Reported US sentencings for card shop operators run from a few months to more than 10 years. Courts add restitution based on losses tied to each card. FBI and DOJ takedowns of card markets in the last decade produced forfeiture orders for servers and cryptocurrency.
PCI DSS requirement 3 forbids storage of sensitive authentication data after authorization. That data includes the CVV, the full track data, and the PIN block. A merchant that keeps CVV data after the transaction is out of compliance. A portal that holds the data holds records no legitimate processor may keep.
Do Carding Websites Accept CVV Sellers? A Security Buying Guide
How these portals work
Most card shops follow one of three models. Automated shops sell records from a searchable list against a balance held in the portal. Escrow shops hold funds until the buyer confirms the card works. Vendor forums list sellers with feedback scores. All three models depend on buyers who cannot report a loss. That fact drives the fraud rate. Fake shops take deposits and close. Real shops get seized. Either outcome costs the buyer money.
Prices quoted in threat intelligence reports range from a few dollars for a card with no balance data to more than $100 for a record with a high credit limit and full identity data. Those figures come from security vendor reporting, not from a verifiable public ledger.
Signals a merchant can act on
- CVV mismatch: decline or step up. Mismatch rates above 1 in 100 orders point to a data source that resells cards.
- AVS mismatch on a billing address that does not match the cardholder record.
- Several cards from one BIN range in a short window.
- Orders shipped to a freight forwarder or a reshipper.
- Device and IP data that do not match the billing region.
For cardholders
- Check statements each week. Small test charges often come before a large one.
- Freeze the card in the issuer app if a charge looks wrong.
- Report fraud to the issuer. Liability for unauthorized use is capped at $50 in the US under the Fair Credit Billing Act, and most issuers waive it.
- File a report at IdentityTheft.gov if a government ID number was exposed.
What to do with a portal you find
Do not create an account, do not send a test payment, and do not download files. Report the domain to the FBI Internet Crime Complaint Center and to the hosting provider. Domain seizure in the US runs through court order, so a report needs the URL and the date you saw it.