The short answer
There is no legal website that sells CVV or CVC codes without registration. A CVV is a three or four digit code printed on a payment card, and its only job is to prove the person typing it holds that card. A service that offers to sell CVV data in bulk is selling stolen payment credentials. A service that offers to sell them with no account, no email, and no paper trail is usually a scam built on top of that trade. In the United States, both sides of the transaction are felonies.
What these sites actually are
Storefronts that advertise CVV sales fall into three groups.
How to Buy CVV/CVC Security for Online Purchases: A Buying Guide
- Carding shops. Automated storefronts that resell card numbers, expiration dates, and CVVs taken from breaches, gas pump skimmers, and phishing kits. They hide behind Tor and cryptocurrency because card networks and investigators shut down anything that stays visible.
- Scams dressed as carding shops. Fake pages that collect a deposit, an activation fee, or a verification payment, then vanish. The operator never had card data. The buyer has no way to complain without admitting to a crime.
- Exit scams and extortion. Sites that take payment, deliver nothing, then threaten to report the buyer unless more money arrives. Buyers are ideal marks because they will not call the police.
Why no registration is the selling point
Dropping the signup step is not a courtesy. It removes the email address, username, and login history that investigators use to connect buyers to a marketplace. It also removes any record the buyer could use to prove a payment was made. That design protects the operator and leaves the buyer with nothing.
What the law says
Under 18 U.S.C. § 1029, it is a federal crime to traffic in unauthorized access devices, a category that includes card account numbers and CVV codes, or to possess them with intent to defraud. Penalties reach 10 years per count, and they climb higher for offenses involving $1,000 or more or committed in support of another crime. Wire fraud and identity theft charges often stack on top. Buying the data is not the lesser offense. Intent to use the numbers is what the statute targets.
How to Sell CVV on a Website: A Guide to CVV/CVC Security for Online Purchases
If you land on one of these sites
- Close the tab. Do not create an account and do not bookmark the address.
- Do not send crypto, gift card codes, or bank transfers. There is no refund path.
- If you already paid, cut off contact with the operator and do not send more money.
- If you are being threatened, save the messages and report the extortion to the FBI Internet Crime Complaint Center.
- If someone sent you unsolicited card data, do not use it, delete it, and report the sender.
- If your own card appeared in a listing, call the issuer and request a new number.
How to protect your own CVV
- Type the merchant domain yourself before entering a CVV, instead of following a link from an email or ad.
- Confirm the checkout page uses HTTPS and that the merchant name matches what appears on your statement.
- Use a virtual card number from your issuer for subscriptions and unfamiliar stores.
- Freeze the card in your banking app when you are not using it.
- Read your statement every week and dispute unknown charges on the day you spot them.
- Report card fraud to the FTC and to your issuer so the incident is on record.
Merchants should never store CVV data at all. PCI DSS requirement 3.2 bars retaining sensitive authentication data after authorization, which is why a breach that exposes CVVs points to a misconfigured payment page rather than a normal order database.