A website that advertises "sell CVV, instant bitcoin" trades stolen payment card data. The CVV is the 3-digit or 4-digit security code printed on a card. Buyers pay in cryptocurrency because transfers cannot be reversed. Selling or buying these records violates United States law. No legitimate bank, processor, or merchant sells CVV codes.
What a CVV Is
CVV stands for Card Verification Value. Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. The code links a transaction to the physical card when the card is not present at the terminal. PCI DSS Requirement 3.2 prohibits storage of the CVV after a transaction is authorized.
What These Listings Contain
Listings on these sites group card records into batches. A record holds a card number, expiration date, cardholder name, billing address, and the CVV. Sellers quote a price per record and a lower price per record in bulk. Payment methods are Bitcoin and, in some cases, Monero. Delivery claims are automated. The sites are unregulated and offer no recourse to buyers.
Sell CVV Website Instant PayPal: Why Those Listings Are Fraud and How to Shield Your Card
Where the Data Comes From
- Data breaches at merchants and payment processors.
- Skimming devices on fuel pumps and ATMs.
- Phishing pages that copy bank login screens.
- Malware on point-of-sale terminals.
- Insider theft by employees with system access.
Legal Status in the United States
18 U.S.C. 1029 covers fraud and trafficking in access devices. A first offense carries up to 10 years in prison and a fine. Certain offenses carry up to 15 years. Wire fraud under 18 U.S.C. 1343 adds up to 20 years. Buying stolen card data is a crime, not only selling it. The FBI and the FTC have shut down carding forums and marketplaces in joint operations.
Steps That Cut Your Risk
- Turn on transaction alerts in your card issuer's app.
- Use virtual card numbers for online checkouts.
- Use tokenized wallets such as Apple Pay or Google Pay.
- Review statements each week, not each month.
- Do not store card data in a browser on a shared or public device.
- Confirm a checkout page uses HTTPS before you enter card data.
If a Card Number Leaks
The Fair Credit Billing Act caps your liability at $50 for unauthorized charges, and most issuers waive that amount. Call the number on the back of the card. Ask for a new card number. File a report at IdentityTheft.gov and a complaint with the FBI Internet Crime Complaint Center.
Reporting a Sales Site
Report the domain to the FTC at ReportFraud.ftc.gov and to IC3 at ic3.gov. Do not send a test payment. Do not contact the seller. A payment in Bitcoin confirms the wallet and cannot be recalled.