Short answer

There is no legitimate market for selling CVVs. The CVV is the 3 or 4 digit verification code printed on a payment card, and the only people who trade in those numbers are thieves. In the US, buying, selling, or dealing in stolen card account numbers falls under 18 U.S.C. § 1029, which covers trafficking in unauthorized access devices. Payment processors, merchants, and card issuers never purchase CVV data from anyone. If a stranger offers you a bulk deal or a "CVV shop," one of two things is happening: they are handling stolen financial data, or they are running a scam and will take your money and hand you nothing.

I look at this from the defensive side, because that is the only side that exists in a normal business. Here is what the term really covers, and how the code gets protected in an honest transaction.

What a CVV actually is

Card networks call it a few things: CVV2 at Visa, CVC2 at Mastercard, CID at American Express, CAV2 at the brands that license Visa tech. Functionally it is a short numeric code that proves the person typing the card number is holding the physical card, or at least has seen it recently.

  • Visa and Mastercard: 3 digits on the back, next to or inside the signature strip.
  • American Express: 4 digits on the front, above the main card number.
  • No magnetic stripe, no chip value: the code exists for card-not-present transactions. It is not stored in the stripe or the EMV chip.

That last detail matters. The code is essentially a shared secret between the cardholder and the issuer, and it is checked in real time during an online authorization.

Why the trade exists at all, and why it is fraud

Online merchants cannot check a signature or a hologram. For decades, the CVV was the main thing separating a real cardholder from someone who had scraped a number off a receipt. Criminals figured out that stolen card numbers are worth much more when sold with the code, because a number alone often fails authorization. So a black market formed, and that market is the entire meaning of the phrase "sell CVV."

None of it is a gray area. There is no licensing scheme, no reseller program, no legal broker. A person selling card data is selling access to someone else's bank account.

What the law says

Federal prosecutors use 18 U.S.C. § 1029 for carding operations, and the penalties scale with the size of the scheme. Possessing 15 or more unauthorized access devices is enough to trigger enhanced penalties. State laws add identity theft and computer crime charges on top. Cases involving large carding rings routinely produce multi-year prison sentences and restitution orders, and the operators, not just the buyers, are the targets.

How the industry blocks this

PCI DSS Requirement 3.2 is blunt: sensitive authentication data, including the full track data, the PIN block, and the CVV, must not be stored after authorization. Merchants are not allowed to keep the code in a database, a log file, a CRM note, or a customer profile. It goes to the processor and it is gone.

That single rule killed the easiest attack path. If no merchant stores the code, then a database breach gives an attacker card numbers without the verification digit, which are far harder to cash out online.

Other controls that matter in practice:

  • Tokenization replaces the card number with a reference value that is useless outside one merchant or one payment network.
  • 3-D Secure and issuer step-up push the verification decision to the cardholder's bank, so the merchant never relies on the code alone.
  • Address verification and velocity checks catch mismatches the code alone would miss.

Signs a stolen card is being tested on your store

Card testing is the visible symptom of CVV trafficking. A stolen batch gets run through small purchases to see which numbers still work. Watch for these patterns:

  1. A burst of low-value orders from the same IP range or device fingerprint.
  2. Many declined authorizations followed by one approval on the same account.
  3. New accounts placing several orders within minutes, each with a different card.
  4. Billing and shipping details that do not match, especially names and ZIP codes.
  5. Orders for gift cards or easily resold goods from first-time customers with expedited shipping.

If you see it, tighten the rules, require step-up authentication for new customers, and report the activity. Do not email the cardholder asking for the CVV. Never ask for that.

Keeping your own code out of someone else's hands

  • Type the number only on a page you reached by navigating to the merchant yourself, not from a link in an email or text.
  • Check that the checkout page is served over HTTPS, and be more careful with small unfamiliar stores than with names you know.
  • Never give the code over the phone to an inbound caller. Your bank will not ask for it.
  • Use virtual card numbers or a payment service that generates single-use credentials when a site looks shaky.
  • Review statements weekly. A one dollar charge you do not recognize is a test, not a mistake.

If your card data shows up somewhere

Call the issuer and ask for the card to be closed and reissued, then dispute any charges. Freeze your credit if identity details leaked alongside the number. In the US, report the fraud to the FTC at IdentityTheft.gov and file a complaint with the FBI's IC3 if the loss is significant, since those reports feed the cases that actually get prosecuted.

The short version: the phrase describes a crime, not a service. Treat every offer that uses it the way you would treat any other pitch from a stranger holding stolen property.