Short answer
There is no trusted place to sell CVVs, because selling a card verification value is not a gray-market transaction — it is a federal crime in the United States. A CVV belongs to the cardholder and the issuing bank. Anyone offering a marketplace, escrow service, or "verified vendor" channel for CVV sales is either committing card fraud or running a scam against the seller. No legitimate processor, acquirer, or payment network will touch the trade.
What the law says
Under 18 U.S.C. § 1029, trafficking in unauthorized access devices covers card numbers, CVVs, and full track data. A single sale can trigger charges for access device fraud, wire fraud, and aggravated identity theft when the data is used. The FTC treats the purchase and sale of stolen payment credentials as identity theft, and the FBI routes card-not-present complaints through its Internet Crime Complaint Center.
What a CVV actually is
The three- or four-digit code on a card exists to prove the physical card is in hand during a card-not-present transaction. It is generated by the issuer and tied to the account. PCI DSS requires merchants to protect it in transit and forbids retaining it after authorization — it cannot be stored, logged, or written to a database even in encrypted form. That is the opposite of a tradeable asset.
Sell CVV to a Legit Shop? No, It Is Card Fraud
If you have card data in hand
- Stop. Do not copy, transmit, or post the data anywhere, including chat apps and paste sites.
- Contact the issuing bank using the number printed on the back of the card and report the exposure.
- File a report with the FBI Internet Crime Complaint Center at ic3.gov.
- Report the identity theft to the FTC at IdentityTheft.gov and keep the report number.
- Document what you saw and where, then delete any local copy once the report is filed.
If you are a merchant handling CVVs
- Confirm your payment page is PCI DSS compliant and that your processor tokenizes card data.
- Disable any logging that captures CVV fields in application or web server logs.
- Verify with your acquirer in writing that CVV is never persisted post-authorization.
- Run a quarterly scan of your checkout flow for exposed card fields.
Legitimate work with card data always runs through an acquirer, a PCI-validated processor, or a law enforcement channel — never a marketplace.
Protecting your own card
Treat the CVV the way you treat a password. Do not read it aloud on calls you did not initiate, do not photograph it, and do not enter it on a site that lacks a valid TLS certificate. Use virtual card numbers from your issuer for unfamiliar merchants so the real code stays private.