There is no lawful way to sell CVV dumps. A CVV dump is a record of someone else's payment card details, and offering it for sale is trafficking in stolen financial information, prosecuted in the United States as access device fraud and identity theft. That answer comes first because the search phrase describes a felony, not a side business. The sections below explain what the term means technically, how the underground trade is structured from a defender's point of view, and which controls on a checkout page actually reduce exposure. The criteria used here are legality, technical accuracy, and practical value to merchants and cardholders.
What a CVV dump actually contains
A dump is a data record lifted from a card, a point-of-sale terminal, or a merchant database. It typically pairs the primary account number with the expiration date, the cardholder name, and the three- or four-digit verification value printed on the card. Full records may also include track data encoded on the magnetic stripe or the PIN block for a debit card. The verification value exists to prove the physical card is present, which is why the payment networks forbid storing it after a transaction authorizes. Once that value is captured and resold, the card can be used in card-not-present channels where the merchant cannot inspect the plastic.
Why the sale is prosecuted rather than tolerated
U.S. federal law treats a payment card account number as an access device. Producing, transferring, or selling access devices with intent to defraud falls under 18 U.S.C. 1029, and cases routinely add wire fraud and aggravated identity theft charges that carry mandatory consecutive sentences. Prosecutors do not need a completed purchase to bring a case; the offer to sell and the possession of the data are enough. Sentences in carding cases commonly include prison time plus restitution to issuing banks and merchants. Civil exposure follows separately, since card network rules let issuers charge back fraud losses to the acquiring bank, which passes them to the merchant.
CVV Dumps for Sale: What the Market Really Is and How to Keep Your Card Data Out of It
How the trade is structured, from a defender's view
Understanding the pipeline is the point of the exercise for fraud and risk teams. Data is captured through skimming devices, malicious scripts injected into checkout pages, breached merchant databases, or phishing pages that harvest entered card details. Records are aggregated, tested against low-value purchases or card-verification endpoints, then sold in batches on closed forums. Tested and verified records command more attention than raw captures. Defenders see the downstream effects as authorization spikes, clusters of small declined charges, and card-testing traffic that hits payment endpoints at high velocity from a narrow set of addresses.
Controls that reduce exposure at checkout
No single control closes the gap, and each has a cost. Weigh them by what they stop and what they break.
Tokenization and hosted payment fields
- Strength: the merchant never holds the account number or the verification value, so a script injection or database breach yields tokens instead of usable card data.
- Limitation: requires integration work, and legacy systems that store raw records must be migrated before the benefit appears.
CVV and address verification checks
- Strength: cheap to enable, catches bulk attempts that pair a stolen number with a guessed verification value.
- Limitation: verified dumps defeat the check, and declines on legitimate customers cost conversions.
Step-up authentication
- Strength: shifts liability for approved transactions in many cases and blocks use of a number alone.
- Limitation: adds friction at checkout and depends on the issuer supporting the flow.
If you find dumps for sale or see your own card listed
Do not buy, test, or forward the records. Report the listing to the platform hosting it, contact the card issuer so the account can be reissued, and file a report through the FTC's identity theft portal. Merchants who discover a breach involving stored verification values should treat it as a reportable incident under card network rules and engage a forensic investigator, since the presence of that data after authorization is itself a compliance failure under PCI DSS.
Recommendation by use case
For a small merchant on a hosted platform, enable the provider's hosted fields and turn on verification value and address checks; that combination covers most card-testing traffic with no engineering effort. For a mid-size retailer with a custom checkout, move to tokenization first, then add velocity rules on the payment endpoint, because those stop automated testing before it reaches the issuer. For a cardholder, the practical step is to keep the printed verification value out of photographs, chat messages, and email, and to review statements for small test charges that often precede a larger fraudulent purchase.