Direct answer
When someone searches for a way to "sell CVV to a shop," they are describing carding, the trade of stolen card verification values and full payment card records through illicit vendors. There is no lawful market for this activity. In the United States, buying, selling, or holding stolen payment card data is a federal crime under 18 U.S.C. § 1029, and the sites that host these listings are subjects of ongoing law enforcement action. Legitimate merchants never purchase CVV data from a third party. If you are a shopper, the useful next step is protecting your own card. If you run a store, the useful next step is hardening checkout against fraud and card testing.
What the CVV actually does at checkout
The CVV or CVC is the three or four digit code printed on a payment card. Card networks designed it to prove that the person entering the card number physically holds the card, or at least knows a value that is not stored on the magnetic stripe. Online checkouts ask for it as an extra check alongside the card number and expiration date. That is also why stolen card data is less useful without it, and why criminal listings often advertise whether a CVV is included.
Why the trade is illegal
Federal law treats payment card account numbers as unauthorized access devices. Trafficking in them, transferring them, or possessing them with intent to defraud carries serious penalties, including prison time and fines. State statutes add parallel charges. A person who buys stolen card data and uses it to place an order commits access device fraud, and in most cases also identity theft. Victims are not only cardholders. Merchants absorb chargebacks, lose inventory, and pay higher processing costs that get passed to every customer.
How card data reaches these channels
- Skimming hardware placed on fuel pumps and ATMs
- Malicious scripts injected into a retailer's checkout page
- Phishing pages that mimic a bank or store login
- Breaches at processors and service providers
- Cards photographed or copied by someone with physical access
Protect your own card: step by step
- Review your card statements once a week and dispute anything you do not recognize.
- Turn on transaction alerts in your bank app so a purchase texts you right away.
- Use a virtual or single-use card number when a site is unfamiliar.
- Decline to read your card number or CVV aloud to anyone who calls you. Banks do not ask for it.
- Freeze your credit file with the three major bureaus if your card data is exposed.
- Request a replacement card with a new number after any confirmed compromise.
If you run a store: step by step
- Require CVV verification on every card-not-present transaction.
- Turn on address verification and require a full match where your risk model allows it.
- Enable 3-D Secure so the issuer authenticates the buyer.
- Set velocity limits on the number of attempts per card and per IP address.
- Never store the CVV after authorization. PCI DSS forbids retaining it in any form.
- Review small-value orders that arrive in bursts. Card testing often starts with a few low-cost charges.
If you find a listing or a stolen card
Report the fraud to the FTC through IdentityTheft.gov and file a complaint with the FBI Internet Crime Complaint Center. If a specific marketplace is hosting card data listings, include the URL in the complaint. Your report helps connect individual cases into patterns that investigators can act on.