There are no legitimate sites to sell CVV dumps. A CVV dump is stolen card data, and selling it, buying it, or running a market for it breaks US federal law under 18 U.S.C. § 1029. What does work is CVV security on the merchant side, and that is where a real comparison belongs.
What a CVV dump holds
A CVV dump is card data lifted from a skimmer, a breached point-of-sale system, or a hacked database. It pairs the card number and expiry date with the three or four digit verification value printed on the card.
Selling CVV Dumps on the Dark Web: A Card Security Guide
- Track 1 or Track 2 magnetic stripe data
- Card number, expiry date, cardholder name
- The CVV2 or CVC2 code from the card
- Sometimes the billing ZIP and issuing bank name
None of that data belongs to the person listing it. The cardholder is the victim, and the issuing bank absorbs the loss.
Is It Easy to Sell CVV Dumps? No, and Here Is Why
Why CVV dump markets burn the buyer
Markets that advertise dumps sit on stolen hosting and rotate domains after seizures. Buyers get no support, no refund, and no proof the data is live.
- Issuers cancel compromised cards, so a large share of any dump is dead on arrival.
- Many listings are fabricated or recycled from older breaches.
- Paying for a listing creates a payment trail that law enforcement can follow.
Fraud forums also run exit scams against their own members. That is the norm in a market with no contracts and no courts.
Where CVV security belongs: merchant-side handling
PCI DSS requirement 3.2 forbids storing the CVV after authorization, even in encrypted form. Sound checkout design keeps the value off your servers from the first keystroke.
Pick first: tokenization inside your payment processor
Processor-hosted fields collect the card and CVV in an iframe your code never touches. The processor returns a token, and your database stores only that token. Stripe Elements, Adyen Components, and Braintree Hosted Fields all work this way.
This one choice shrinks your PCI scope and removes the whole question of CVV storage. Most small and mid-size stores should start here.
Option 2: a gateway with CVV verification and fraud scoring
If you route volume across several acquirers, or you need a risk score at the moment of sale, a gateway layer earns its fee. Stripe Radar, Adyen RevenueProtect, and Braintree with Kount score each transaction using device data, card history, and velocity checks.
You still never store the CVV. The gateway passes it to the issuer, gets a match or no-match response, and hands you a decision.
Option 3: virtual card numbers for shoppers
Shoppers can cut their own exposure with single-use numbers. Privacy.com, Capital One Eno, and Apple Card all issue virtual numbers tied to one merchant or one purchase.
A number that leaks from a breached store is useless once it is locked to a different merchant. This is the cheapest defense a consumer can add today.
How the options compare
- Stripe: hosted fields, Radar fraud scoring, token billing. Best fit for startups, SaaS, and small retail.
- Adyen: one platform for online and in-person payments, built for high volume and multi-country selling.
- Braintree: Kount scoring plus PayPal in a single integration, useful for marketplaces.
- Virtual cards: consumer-side defense with no merchant integration, good for shoppers who buy from unfamiliar stores.
Every merchant option shares one trait: the CVV is verified and dropped, never kept. None of them involve buying card data from anyone.
Common questions
Is buying or selling CVV dumps a crime?
Yes. 18 U.S.C. § 1029 covers producing, selling, and possessing unauthorized access devices with intent to defraud. Penalties climb to 10 and 15 years for large-scale or repeat offenses.
Can I keep the CVV to catch repeat fraud?
No. PCI DSS bars retaining the value after authorization. Use the token, the device fingerprint, and a fraud score instead.
What should I do if my own card shows up in a dump?
Call the issuer and ask for a new card number. US cardholders carry zero liability for unauthorized charges reported fast, and most banks reverse them without argument.
How do I test CVV handling in my checkout?
Use the test card numbers from your processor's sandbox. Never test with a live card, and never log the CVV field, even in debug mode.
Next steps for store owners
- Move card capture to hosted fields so the CVV never reaches your server.
- Turn on a fraud scoring tool and set rules for velocity and mismatched address data.
- Audit your logs for any field that could hold a CVV, then delete it.