Selling CVV dumps on the dark web is the trade of stolen payment card records, moved in bulk from thieves to buyers who use them for fraud. Each dump carries the card number, expiration date, and CVV/CVC security code, which is enough to place card-not-present orders at online shops. US law treats the trade as a felony under 18 U.S.C. § 1029, with prison terms that reach 10 years for some offenses and 15 for others.
Top Sites to Sell CVV Dumps Comparison Review
For shoppers, the practical point is short. If your card data lands in a dump, the CVV is the field that lets a stranger spend your money online, and that field stops working the moment you replace the card number.
What does a CVV dump contain?
A dump is a record of one card, formatted so it can be listed and resold. Formats differ by market, but the core fields stay the same.
- Full card number (PAN)
- Expiration date
- CVV2/CVC2 code, the three or four digits printed on the card
- Cardholder name and billing address or ZIP, when included
- Issuer name and card brand
- Country, and sometimes the bank phone number used for verification calls
Sellers split stock by how much data comes with the card. A record marked "with CVV" costs more than one without the code, because it survives the verification step that most online checkouts run.
How to Buy CVV Dumps from Sellers Safely
How does stolen card data reach a dark web market?
Every dump starts as a theft, and the paths are documented.
- Skimming and shimming at gas pumps and ATMs, where a hidden device copies the magnetic stripe.
- Phishing and fake checkout pages that collect card details typed by a victim.
- Web skimming scripts injected into a retailer's checkout page to lift payment fields.
- Merchant and processor breaches, where a database of stored records gets copied.
- Brute-force BIN attacks, where bots guess card numbers and test them against weak checkouts.
- Malware on a personal device that captures payment data saved in a browser.
Stolen records move through carding forums, encrypted chat groups, and automated shops that sell a file and hand it over in seconds. Payment inside those markets runs on cryptocurrency, which makes tracing hard.
Why is the CVV the most valuable field?
Card networks built the CVV as a check that a thief cannot copy from a card number alone. Merchants must ask for it on card-not-present orders, and PCI DSS forbids storing it once the authorization ends, so a breach of a merchant database gives up numbers without codes.
That gap explains the price difference. A buyer pays more for a record with the code because it clears the checkout's verification filter, at least until the issuer blocks the card.
How fast does a stolen record stop working?
Not long. Issuers watch for patterns such as many small buys, purchases far from a cardholder's home, and several merchants hit with the same BIN in a short window. A flagged card gets frozen, and the dump becomes dead stock.
Card replacement, 3-D Secure prompts, tokenization, and machine-learning risk scores all cut the useful life of a stolen record. That is why sellers push volume instead of holding inventory.
How can you tell if your card data is in a dump?
You often cannot tell until a charge lands, but some signals arrive first.
- A small charge you do not recognize, often under a few dollars, used to test the card.
- A fraud alert or text from your issuer asking you to confirm a purchase.
- A card that stops working at checkout, even though you never reported it lost.
- A data breach notice from a store where you shopped.
- Password reset emails or login alerts for retail accounts.
Card testing is the loudest sign. Thieves run low-value charges before they attempt a large buy, and issuers flag that pattern.
What should you do if your card is exposed?
- Freeze or lock the card in your banking app, then call the number on the back to report fraud.
- Ask for a new card number, not just a reissued card with the same number.
- Review statements for the past 60 days and dispute anything you did not buy. US cardholders have zero-liability protection for unauthorized charges.
- Change the password on any shopping account that stored the card, and turn on two-factor authentication.
- Set transaction alerts for every purchase so the next test charge reaches you the same day.
- Use virtual card numbers or a wallet that shares a token instead of your real number for online orders.
What stops dumps from working in the first place?
Merchants and issuers carry most of the defense, and the controls are known.
- Tokenization: the real card number never touches the merchant's systems.
- 3-D Secure: the issuer asks the shopper for a second factor before the sale completes.
- Address Verification Service (AVS): the billing address and ZIP must match the issuer's record.
- CVV requirement: a checkout that skips the code loses a key filter.
- Velocity and device checks: many cards on one device, or many cards from one IP range, get blocked.
- PCI DSS compliance: no storage of CVV data, encryption of the rest, strict access control.
Shoppers add a layer by using virtual cards, keeping card data out of unfamiliar sites, and paying with a wallet that shares a token instead of the number.
Frequently asked questions
Is selling CVV dumps on the dark web illegal?
Yes. In the US, trafficking in stolen card credentials falls under 18 U.S.C. § 1029, and similar laws apply in the UK, the EU, Canada, and Australia. Convictions bring prison time, fines, and restitution.
Can a dump work without the CVV?
Sometimes, at merchants that skip the code or that process a recurring charge created earlier. Those records sell for less and fail more often. This is why the CVV field carries so much weight in card-not-present checkout.
Does buying on the dark web put a buyer's own data at risk?
Yes. Buyers hand cryptocurrency and personal details to criminals, and the market operators keep both. Fake shops, exit scams, and malware downloads are routine outcomes for anyone who tries to buy.
How long does a stolen card stay active?
Usually days, sometimes hours. Issuers and card networks block a card as soon as fraud scoring flags it, and replacement is fast. Any "valid rate" a seller quotes describes a short window.
Does the dark web affect card-present shopping?
Less than it used to. EMV chips generate a unique cryptogram per transaction, so a copied card number alone cannot clone a chip sale. Online checkout stays the softer target, which is why CVV dumps draw attention.
The bottom line for cardholders
A CVV dump is a stolen card record plus the one field that lets a stranger buy online. The trade is criminal, the data is short-lived, and the defenses on your side are plain: alerts on, cards locked when unused, virtual numbers for online orders, and a fast call to your issuer when a test charge appears.