There is no legitimate market for selling CVV data. A CVV or CVC is the three- or four-digit security code printed on a payment card, and the only parties with a lawful reason to handle it are the cardholder and the issuing bank that validates it during an authorization. Anyone offering to pay you for CVVs is either recruiting you into access device fraud, which is a federal offense in the United States under 18 U.S.C. § 1029, or running a scam that targets you rather than a bank. The sections below explain what the code does, why trafficking in it is prosecuted, and what to do instead if your real goal is income or a career in payments.
What a CVV actually does
The card verification value is generated by the issuer and tied to the card account and, in most implementations, to the card itself. It is not embossed with the account number and it is not meant to be memorized by anyone other than the cardholder. Its whole purpose is to prove that whoever is submitting a transaction has physical possession of the card, which is why online checkout forms ask for it and why a keyed-in transaction without it carries a higher fraud risk.
There are two common forms. The code encoded on the magnetic stripe is read by a terminal during a face-to-face swipe or dip. The code printed beside the signature panel is the one typed into web forms. Both are authentication features, and both are treated as protected data under the Payment Card Industry Data Security Standard.
Selling CVV 2024: What You Need to Know
Why selling CVVs is prosecuted, not tolerated
US law does not distinguish between selling a card number and selling the code that unlocks it. Section 1029 of Title 18 covers trafficking in unauthorized access devices, and a card verification value falls inside that definition when it belongs to someone else and is offered without authorization. Penalties scale with volume: up to 10 years for an offense involving a single device and up to 15 years when more devices are involved, with fines on top. Separate charges for aggravated identity theft under 18 U.S.C. § 1028A can add a mandatory two-year term that runs consecutively to the underlying sentence.
State statutes cover the same conduct, and financial institutions pursue civil recovery. The practical point is that this is not a gray area with a small fine attached. It is a felony category that federal agents work on with card networks and issuing banks.
Why almost every "sell CVV" offer is a scam aimed at the seller
People who ask where to sell CVV data usually picture a buyer with money and a marketplace with escrow. What they encounter is a set of well-worn patterns:
- Advance fees. The buyer asks for a deposit, a "verification" payment, or gas money before the deal closes, then disappears. The deposit is the actual product being sold, and you are the customer.
- Free sample requests. You are asked to send a few codes to prove quality. Those codes are the payment, and no purchase follows.
- Account takeover. The conversation moves to a chat app, then to a request for your own banking details, identity documents, or a screen share so the buyer can "confirm" you.
- Law enforcement. Some of the buyers behind these accounts are investigators building a case, and the chat log becomes the evidence.
The economics also fail on their own terms. Cardholders dispute unauthorized charges, issuers reverse them, and the account tied to the transaction gets closed. What looks like a sale is a short-lived chargeback that generates a fraud record with your name and device attached to it.
For merchants: legitimate ways to reduce CVV exposure
If your interest in card security comes from running a store, the useful question is how to collect the code without keeping it. PCI DSS Requirement 3.2 bars storing the card verification value after authorization under any circumstances, including encrypted storage. That constraint shapes the three common architectures below.
Hosted payment fields
The card form is rendered inside an iframe or hosted page controlled by your payment processor, so the code is submitted directly to them and never passes through your servers.
- Pros: the smallest compliance scope, minimal engineering work, and the processor absorbs most of the sensitive data handling.
- Cons: less control over the look of the checkout, occasional friction with custom cart flows, and dependence on the processor's uptime.
Network tokenization
The card is replaced with a token issued by the card network, and the real code is never stored or re-sent by the merchant.
- Pros: strong fit for subscriptions and repeat billing, tokens survive card reissuance, and authorization rates tend to hold up better than raw stored credentials.
- Cons: setup effort with the processor and network, and token portability depends on which provider you choose.
Point-to-point encryption at the terminal
Card data is encrypted at the moment of the swipe or dip and decrypted only inside the processor's environment.
- Pros: well suited to physical locations, keeps the code out of the POS system, and simplifies scope for in-person sales.
- Cons: hardware cost, key management overhead, and no benefit for online-only checkouts.
Recommendation: an online store should start with hosted payment fields, since it delivers the largest scope reduction for the least work. Add network tokenization when recurring billing becomes a meaningful share of revenue. Choose point-to-point encryption only if you operate physical terminals and want the same protection applied there.
For cardholders: keeping your own code out of circulation
Never read a security code to someone who calls you, and never type it into a page reached through a link in an unsolicited message. A bank that is genuinely contacting you already knows the card is yours and does not need the code to prove it. Virtual card numbers, available from several major issuers, generate a separate code for each merchant, so a leaked number has a short useful life. Turn on transaction alerts, and freeze the card from the issuer's app the moment a charge you do not recognize appears.
Legitimate work in card security
There is real demand for people who understand how card data moves. Fraud analyst, chargeback analyst, trust and safety investigator, payments engineer, and PCI assessor are all roles that pay for exactly the knowledge someone asking about CVV sales is trying to acquire, without the exposure. Fraud teams at issuers and processors hire continuously, and the entry path usually runs through transaction monitoring, disputes, or customer authentication support.
If a stranger has already approached you with an offer to buy codes, keep the messages, stop responding, and report the contact to the card issuer named on the card and to the FBI's Internet Crime Complaint Center. That report is the only part of the transaction that works in your favor.