The short answer
There is no legal way to sell CVV data or operate a website built for carding. Carding means using stolen card account numbers to buy goods, load gift cards, or move money, and every stage of that chain is a federal crime in the United States. Sites that advertise CVV for sale run on stolen data and exist to defraud cardholders and merchants. If you searched this term to protect a card, a store, or a family member, the sections below explain how CVV and CVC protection works, how carding shows up on statements, and what to do instead.
What the term covers
A CVV or CVC is the three or four digit verification code printed on a payment card. It exists to prove that the person entering the number physically holds the card. Carding operations try to collect that code along with the card number, expiration date, and cardholder name so they can approve online orders without the plastic in hand. A site that sells this data is a storefront for stolen financial records, not a service.
Why no business can legally sell CVV data
PCI DSS Requirement 3.2 prohibits merchants and processors from storing sensitive authentication data, including the full magnetic stripe, the CAV2, CVC2, CVV2, and CID codes, after an authorization. The code may pass through the payment network for a single transaction and then must not be retained. That rule means a legitimate processor has nothing to sell. Any entity offering CVV records for sale obtained them outside the payment system, which is the definition of trafficking in unauthorized access devices under 18 U.S.C. 1029.
How to Sell CVV Websites for Carding in 2024
How card data reaches those sites
- Data breaches at merchants, hotels, and processors that expose stored card numbers.
- Phishing pages and fake checkout screens that copy form entries.
- Skimming devices and overlay hardware placed on fuel pumps and ATMs.
- Malware on a home or small business computer that scrapes browser sessions.
- Social engineering calls that pressure a cardholder into reading the code aloud.
How to spot carding fraud on your account
- Review every posted transaction in your banking app at least once a week.
- Flag small test charges, often under two dollars, from unfamiliar merchants.
- Check for repeated declines or verification prompts you did not trigger.
- Watch for delivery notifications for orders you never placed.
- Report anything unfamiliar to the issuer the same day you find it.
How to protect your card and CVV
- Enter the CVV only on a checkout page you reached by typing the merchant domain yourself.
- Turn on transaction alerts for every card you carry.
- Use a virtual or single-merchant card number for subscriptions and one-off purchases.
- Never read the code to someone who calls you, even if the caller ID looks like your bank.
- Freeze your credit and keep card replacements coming to a locked mailbox.
If your card number is compromised
- Call the number on the back of your card and ask for the fraud team.
- Request a new number and a new CVV rather than a replacement of the same account.
- Dispute each unauthorized charge in writing and keep the confirmation.
- Change passwords on any shopping account that stored the card.
- File a report at the FBI Internet Crime Complaint Center and keep the reference number.
How merchants block carding attempts
- Require the CVV on every card-not-present order and reject stored-code shortcuts.
- Run address verification against the issuing bank before capture.
- Apply velocity limits to card numbers, IP addresses, and device fingerprints.
- Trigger 3-D Secure step-up authentication when the risk score rises.
- Escalate bulk orders of resellable goods to manual review.
Carding has a short shelf life because issuers, networks, and merchants share fraud signals in near real time. That is why no honest vendor competes in this space and why the sites that do appear and vanish quickly. Defending a card is a matter of controlling where the CVV is typed, watching the account, and acting fast when something looks wrong.