Short answer: there is no legitimate shop that buys CVVs. A CVV is a security code built to prove the person holding the card is physically holding it. It is never meant to change hands, and no honest merchant, processor, or reseller has a reason to purchase one. If a site or a contact offers to buy a CVV from you, treat it as either a scam aimed at you or a front for stolen card data. Selling one is trafficking in payment credentials, which is a federal crime in the United States.
What a CVV really is
CVV stands for card verification value. Visa uses that name, Mastercard calls it CVC, American Express calls it CID. You see three digits on the back of most cards, four on the front of Amex. The number is generated from the card data plus a key that only the issuer holds, so it cannot be guessed by anyone who skims a card number alone.
That is the whole point. A stolen card number without a valid code is much less useful. The code is a possession check, not an identity check.
where sell cvv legit with bitcoin
Card network rules also forbid storing the code after a transaction is authorized. PCI DSS requirement 3.2 states plainly that sensitive authentication data, which includes the CVV, must not be retained after authorization. So a business that says it wants to buy CVVs is admitting it plans to keep data it is not allowed to keep.
Why the phrase "legit shop" shows up at all
The wording comes from carding forums. Sellers there call themselves shops, grade their inventory, and use words like legit, fresh, and high balance to build trust. It is marketing language borrowed from ordinary ecommerce to make an illegal trade feel normal.
I have read enough of these listings to notice the pattern. The pitch is always the same: send the data first, get paid after verification. The buyer then disappears, or claims the code failed, or asks for a small test batch and vanishes. When money does change hands, the seller is the one holding a record of the transaction. That record is evidence.
Some of these operations are run by law enforcement as stings. Others are run by people who collect card data for their own use. Neither outcome is good for the person who sent the CVV.
The legal side, in plain terms
In the US, 18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Card numbers, codes, and account credentials fall under that definition. Trafficking in them, even one, carries potential prison time and fines. State laws stack on top of that. Card issuers also pursue civil recovery.
"I did not use the card" is not a defense. The statute targets the transfer itself.
If you run a shop, here is what to watch for
- Anyone offering to sell you card data in bulk, or offering a "test pack" before a larger order.
- Customers who push to complete an order without the CVV, or who ask you to store it "for next time."
- Contact forms or support chats pitching payment data as a product. Real processors do not do this.
- Unusually high approval rates on manual card entry, which often signals testing with stolen numbers.
The defense is boring and effective: never store the CVV, require it on card-not-present transactions, use address verification alongside it, and turn on 3-D Secure for higher-risk orders. Tokenization keeps the real number out of your systems entirely.
If you are the one holding the card data
Maybe a relative died and left account paperwork, or a card arrived that is not yours. Do not sell it, do not post it, do not send it to a stranger who promises payment. Call the issuer using the number on the back of the card and report it. That call costs nothing and it is the only route with no legal exposure.
The short version: a real shop sells things to customers. It does not buy security codes. Any offer that says otherwise is a trap with better branding.