Selling CVV dumps on the dark web is a federal crime in the United States, not a skill any guide can teach safely. Trafficking stolen card numbers and verification codes violates 18 U.S.C. § 1029, and each count can carry a statutory maximum of 10 to 20 years in prison plus restitution to banks and cardholders. There is no lawful marketplace, no safe escrow, and no legitimate tutorial for it. This page explains the legal reality and the security controls that actually stop card fraud.
Is selling CVV dumps on the dark web legal?
No. A CVV dump is an unauthorized access device under federal law, and offering one for sale is the exact conduct the statute targets. US attorneys charge these cases as access device fraud, identity theft, and often money laundering when cryptocurrency is used. Buyers, sellers, and intermediaries all face exposure.
What penalty does 18 U.S.C. § 1029 carry?
Most access device offenses carry a statutory maximum of 10 years, with higher maximums for aggravated counts involving large volumes of devices or equipment used to make them. Courts add restitution orders, supervised release, and forfeiture of proceeds and hardware. Sentences stack across multiple counts and multiple victims.
- Federal prison time per count, not a single merged sentence
- Mandatory restitution to issuers and cardholders
- Forfeiture of devices, accounts, and cryptocurrency
How do card data thieves actually get caught?
Card data has a short commercial life. Issuers can void a BIN range within hours of a fraud spike, and chargebacks reverse the profit that buyers expected. That dynamic pushes sellers toward repeat transactions, which is where identity and device fingerprints accumulate.
Payment processors, card networks, and the FBI Internet Crime Complaint Center track patterns across reports. Cryptocurrency trails, shipping addresses, and forum identities link cases together long after the original sale. Prosecutors routinely build a timeline from several years of activity.
Why is a CVV never supposed to be stored?
PCI DSS forbids retaining the card verification value after authorization, so a legitimate merchant has no CVV database to leak. Data offered as dumps therefore comes from skimmers, phishing, malware, or breached merchant systems, not from compliant processors. Tokenization and EMV chip cryptograms further reduce the value of a bare number.
How do shoppers and merchants block CVV fraud?
Merchants should require CVV entry on card-not-present orders, apply address verification, and use risk scoring on velocity and device data. Shoppers should enable transaction alerts, avoid saving cards on unfamiliar sites, and never read a code aloud to an unsolicited caller.
- Enable real-time purchase notifications in the card app
- Freeze the card immediately if a charge is unrecognized
- Report card fraud at IdentityTheft.gov and to the card issuer
What should you do if your card appears for sale?
Report it. Close the card, request a new number, and file a report with the FTC and the FBI Internet Crime Complaint Center. Documenting the report protects you from liability and adds data that investigators use to pursue the sellers.