Websites that advertise CVV numbers for sale are criminal storefronts. In the US, buying, selling, or holding card data with intent to defraud violates 18 U.S.C. 1029. A first offense carries up to 10 years in prison. A second carries up to 15. The product is also bad: most listings are fake, stale, or bait.

Comparative Review: Best CVV Websites for Carding Reviews

What a CVV is

The card verification value is a 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. Issuers compute it from the account number and a secret key. The printed code (CVV2 or CVC2) never sits in the magnetic stripe. The stripe holds a different value, CVV1, which terminals read.

related article

Card networks built the printed code for card-not-present orders: phone, mail, and web. A merchant that asks for the code proves the buyer holds the physical card. A merchant that stores the code after authorization breaks PCI DSS Requirement 3.2.

CVV/CVC Security: How Carding Sites Operate and How to Protect Your Card

Why the sale sites do not work

  • Payment runs on crypto or escrow bots with no refund path. The seller keeps the funds.
  • One card record is sold to many buyers. The first test charge trips the issuer's fraud model and the card dies.
  • Full data sets include the billing address, so address verification checks pass once and fail after the real holder reports the card.
  • Some storefronts are law enforcement honeypots. Some are exit scams that close after 30 days.
  • Site operators log buyer IPs and wallet IDs. Those logs become evidence.

Legal exposure in the US

18 U.S.C. 1029(a)(3) covers possession of 15 or more unauthorized access devices. Fifteen cards is the threshold. Aggravated identity theft, 18 U.S.C. 1028A, adds a mandatory 2-year sentence on top of the underlying count when the card belongs to a real person. Federal sentencing guidelines add levels for the number of victims and the loss amount.

carding cvv website sell

How CVV codes leak

  • Skimmers on fuel pumps and ATMs that copy the stripe and a camera view of the keypad.
  • Phishing pages that ask for the code plus the account number plus the one-time password.
  • Merchant breaches that kept the code in a database.
  • Fake support calls that ask the holder to read the code aloud.
  • Screen capture malware on phones and laptops.

Checks a merchant runs at checkout

  1. Address Verification System: compares the billing street number and ZIP to the issuer file.
  2. CVV match: issuer returns match, no match, or not processed.
  3. 3-D Secure: the issuer challenges the cardholder in a bank window.
  4. Velocity rules: order count per card, per IP, per device.

Protect your own card

  • Use virtual card numbers from your issuer for online checkouts. Each number ties to one merchant.
  • Freeze the card in the bank app when you are not shopping.
  • Turn on transaction alerts for every charge above $1.
  • Do not read the code to a caller. No bank asks for it.
  • Cover the back of the card with your hand at a counter.

If your code is exposed

  1. Call the number on the back of the card and ask for a new account number and code.
  2. Dispute charges you do not recognize within 60 days of the statement date.
  3. File a report at IdentityTheft.gov to get a recovery plan.
  4. Report the fraud at ic3.gov. The FBI uses those reports to trace seller networks.

There is no legal market for CVV numbers. A search for one returns fraud shops, resold data, and criminal charges.