Short answer
There is no legal market where a person sells CVV data to a shop. A CVV is cardholder authentication data. It belongs to the cardholder and the issuing bank. Selling, buying, or brokering it without authorization is access device fraud under 18 U.S.C. § 1029 in the United States. A commission rate of zero does not change that status. Offers that advertise "zero commission" on CVV sales are either criminal solicitations or scams aimed at the seller.
What a CVV is
A card verification value is a 3 or 4 digit code printed on a payment card. It is not stored in the magnetic stripe or the chip. Online merchants ask for it to confirm that the buyer holds the physical card. The code is classified as sensitive authentication data (SAD) under PCI DSS.
CVV/CVC Security Guide: Online Purchases and Dump Scams
PCI DSS Requirement 3.2 states that SAD must not be stored after authorization, even if encrypted. A merchant that keeps CVVs in a database is out of compliance, and the data becomes a target for theft.
which cvv shop has no commission?
Why shops do not buy CVV data
- Issuing banks do not transfer cardholder data to third parties for resale.
- Acquiring banks terminate merchant accounts that handle card data outside the network rules.
- Card networks impose fines and chargeback liability on merchants that store SAD.
- A shop that pays for CVV data cannot settle the resulting transactions through a card network without triggering fraud detection.
How "zero commission" offers work
Listings that promise zero commission on CVV sales appear on carding forums, chat channels, and unmoderated marketplaces. Three patterns repeat.
- Escrow fraud. The operator holds the data or the payment, then closes the account. The seller receives nothing.
- Data harvesting. The seller submits a sample to prove quality. The operator keeps the sample and blocks the seller.
- Law enforcement operations. The FBI and partner agencies run and seize carding infrastructure. Sellers who submit data identify themselves.
Legal exposure
18 U.S.C. § 1029 covers the production, sale, and possession of access devices with intent to defraud. Penalties reach 10 years for a first offense and 15 years for repeat offenses. 18 U.S.C. § 1028A adds a mandatory 2 year term when the conduct involves aggravated identity theft. The FTC and state attorneys general also pursue civil claims, and card networks assess fines against merchants.
Numbers vary by case. Public sentences in carding cases have ranged from probation to more than 10 years.
What merchants should do instead
- Tokenize card data at the point of entry so the CVV never reaches your servers.
- Use a hosted payment page or an iframe from a PCI validated processor.
- Verify addresses with AVS and require CVV checks on every authorization.
- Log failed CVV attempts and route them to manual review.
- Report suspected card fraud to the FTC at ReportFraud.ftc.gov and to the card issuer.
Merchants who need payment card data for legitimate business keep it inside the PCI DSS scope, and they never buy it from a third party.