No legitimate shop pays for a CVV. A CVV is a 3 or 4 digit security code printed on a card. It exists to prove the cardholder has the physical card. No merchant, processor, or retailer buys it. Any offer that promises payment for card numbers, CVVs, or fullz is fraud recruitment or an advance-fee scam. The person who sends the data is the one who loses.
What the offer looks like
The pitch arrives by Telegram, Discord, WhatsApp, email, or a job posting. Common forms:
- "Send your CVV, get $50 per card."
- "We buy CVV lines, 60/40 split."
- "Card verification job, keep the card, we only need the code."
- "Test purchase work, we send the goods, you keep a cut."
Each version asks for the same three things: card number, expiry date, and the CVV. Once those three reach a buyer, the card is usable for online purchases with no further check.
Why no merchant buys CVVs
A merchant receives card data from the payment processor during checkout. The data arrives as part of the authorization request. The merchant does not need to buy it. PCI DSS rule 3.2 forbids storing the CVV after authorization, so holding a pool of CVVs is a compliance violation on its own.
How to Shop for CVV Dumps Safely
Card data has no legal wholesale market. There is no product, no invoice, and no buyer with a business address. The only market is the criminal one, and it does not pay the person who supplies the card.
The two ways the sender loses
1. Advance fee
The "shop" asks for a deposit first: a verification fee, a wallet activation, a minimum balance. The deposit clears, the payout never comes, and the account is blocked.
2. Data collection
The shop keeps the CVV and pays nothing. The sender's card is then charged for goods shipped elsewhere. The sender discovers the loss at the next statement, and the chargeback lands on the sender's own account.
3. Money mule role
Some offers ask the sender to receive a transfer and forward part of it. That transfer is often the proceeds of a card fraud. Forwarding it converts the sender from a victim into a participant.
Legal exposure in the US
- 18 U.S.C. § 1029 covers trafficking in access devices. Penalties reach 15 years for a first offense and 30 years for a subsequent one.
- 18 U.S.C. § 1343 covers wire fraud. Penalties reach 20 years.
- 18 U.S.C. § 1956 covers money laundering. Penalties reach 20 years.
Penalties scale with the number of cards and the dollar value. A single card can support a federal charge when it crosses state lines.
What to do if you already sent card data
- Call the number on the back of the card and report the card as compromised.
- Ask the issuer to close the account and issue a new number with a new CVV.
- Review statements for charges you do not recognize and dispute each one in writing.
- Change the password on the card issuer account and turn on transaction alerts.
- Report the offer to the FTC at ReportFraud.ftc.gov and to the FBI IC3.
- Keep the chat logs, wallet addresses, and screenshots. Investigators ask for them.
How legitimate card work is paid
Work that involves card data exists: payment processing, fraud analysis, chargeback review, and PCI auditing. Each role is paid a salary or contract rate by an employer. None of them pays per CVV. None of them asks a worker to send a live CVV through a chat app.
Checks before replying to any offer
- Does the offer name a company, a tax ID, and a contract? If not, it is not a job.
- Does it ask for a deposit before payment? That is an advance-fee pattern.
- Does it ask for the CVV but not the cardholder name? No real processor does that.
- Is the contact on a chat app with no verifiable identity? The account will vanish after payment.
- Does it promise a percentage of a card balance? That is a cash-out scheme, not employment.
One rule covers all cases. A CVV stays with the cardholder. Any request to send one is a signal to stop the conversation.