Short answer
Selling CVV dumps is a federal crime in the United States. A CVV dump is a set of card data that carries the card number, the expiration date, or the verification code. Selling that data counts as trafficking in access devices under 18 U.S.C. 1029. A first offense carries up to 10 years in prison. A second offense carries up to 15 years. There is no beginner track into this market. Court dockets are the record.
What the term means
Dump data is a string of numbers pulled from a card. Sets sold on crime forums hold some or all of these fields:
Best Way to Sell CVV Dumps in 2024
- Primary account number (PAN), 15 or 16 digits
- Expiration date
- CVV2 or CVC2, the 3-digit code on the back of Visa and Mastercard cards
- CID, the 4-digit code on the front of American Express cards
- Cardholder name and billing ZIP
The CVV is a check value. The issuer computes it from the PAN and a secret key. It proves the physical card is in hand.
Why the CVV exists
PCI DSS Requirement 3.2 bars storage of the CVV after an authorization. That rule removes most of the value from a stolen payments database. A thief who copies a merchant table gets a PAN and no code.
How card data leaves a cardholder
- Skimmers on fuel pumps, ATMs, and self-checkout lanes
- Phishing pages that copy a checkout screen
- Breaches at merchants, processors, and hotels
- Malware on a home computer that logs keystrokes
How fraud gets caught
Card networks score each authorization in under one second. The score uses BIN range, merchant category, transaction amount, device fingerprint, and IP location. A card issued in Ohio and used at a store in Romania flags on the geo mismatch. Issuers also run velocity checks: 4 declines on one BIN in 10 minutes triggers a block. Address Verification System and CVV checks match the entered digits against issuer records. A failure shifts liability to the merchant on card-not-present orders.
Loss numbers
The Nilson Report puts US card fraud losses above 10 billion dollars per year. The FTC receives card fraud complaints in the hundreds of thousands each year. Only a small share of losses trace to dumps sold one at a time.
What merchants should do
- Require the CVV on every card-not-present order.
- Turn on 3-D Secure for high-risk categories.
- Tokenize stored card numbers.
- Block PAN storage for the CVV field in the database schema.
- Set velocity limits per IP, email, and BIN.
What cardholders should do
- Freeze the card in the issuer app.
- Read 3 months of statements for small test charges.
- File a report at IdentityTheft.gov.
- Request a new PAN and a new CVV.
Bottom line
Dump selling is a target for federal task forces. Cases start with a single skimmed card and end with a search warrant. A buyer risks a fraud charge on the first order placed with a stolen PAN. The safe path is to learn how issuers and networks block this traffic, then build checkout systems that follow the same rules.