No, you cannot sell a CVV to a legitimate shop. A CVV or CVC is a security code tied to one specific card and account, and it is never a product a business purchases. Any offer to "sell CVV to a legit shop" is either an illegal fraud scheme or a scam aimed at the person doing the selling.
What Is a CVV or CVC Code?
The CVV, or card verification value, is the three-digit code on the back of most Visa, Mastercard, and Discover cards. American Express prints a four-digit code on the front, called the CID. The code is derived from the card number, expiration date, and issuer keys, so it confirms that whoever is paying has access to the physical card.
Can a Legit Shop Buy CVV Numbers?
No. Legitimate merchants collect payment through card networks, payment processors, and acquiring banks. They receive an authorization approval or decline, not ownership of the cardholder's verification data, and they do not buy card records from anyone.
Under the PCI DSS framework, a merchant may use the CVV to authorize a single transaction but must not store it afterward. That rule exists because CVV data has no legitimate resale value to a business.
Why "Sell CVV to Legit Shop" Offers Are Illegal or Fraudulent
- Buying or selling card verification data is card fraud under 18 U.S.C. § 1029 and comparable state statutes.
- Real shops have no purchasing process for CVV codes, so any supposed buyer is likely running an advance-fee or money-mule scam.
- Sellers often hand over bank details, identity documents, or crypto payments that are then taken from them.
What Penalties Apply for Card Data Trafficking?
In the United States, trafficking in card credentials carries up to 10 years in prison for a first offense and up to 15 years for repeat offenses, plus fines. Sentences grow when an offense involves multiple cards or large dollar amounts. Civil claims from banks and cardholders can be added on top of criminal penalties.
How Merchants Legitimately Verify a Card
- Collect the card number, expiration date, and CVV at checkout over an encrypted connection.
- Send the authorization request to the payment processor, which routes it to the issuing bank.
- Receive an approval or decline response, and store only a masked card number if needed.
- Never retain the CVV, and keep it out of databases, logs, and support tickets.
Is Selling Your Own CVV Ever Allowed?
No legitimate business pays for a cardholder's verification code, whether the cardholder volunteers it or not. A person who hands over their own CVV in exchange for money is still participating in a fraud scheme and risks losing account access and legal protection. There is no lawful marketplace for this data.
How Consumers Protect Their CVV
Do not read a CVV aloud in a public place or send it by text or email. Enter it only on a checkout page that uses HTTPS and belongs to a business you trust. If you think your code was exposed, contact your card issuer right away and ask for a replacement card.
Federal law caps your liability for unauthorized credit card charges at $50, and most issuers waive that amount entirely. That protection is one reason card fraud schemes target sellers rather than buyers.
Frequently Asked Questions
Is a CVV the same as a PIN?
No. A PIN is a secret number the cardholder chooses and enters at an ATM or terminal. A CVV is generated by the issuer and printed on the card for remote transactions.
Do online stores keep my CVV?
Compliant merchants do not store the CVV after the transaction is authorized. If a site saves the code for future use, treat that as a serious security warning.
What should I do if someone asks to buy my CVV?
Refuse, stop communicating, and report the request to your card issuer and to the FTC at ReportFraud.ftc.gov. Keep the messages as evidence.