The short answer
You cannot legally sell CVV dumps. A dump is a file of stolen card numbers with the verification code attached, and moving one is trafficking in stolen payment credentials, not a side hustle. In the US that lands under 18 U.S.C. § 1029, which covers producing, selling, and transferring unauthorized access devices. A first offense carries up to 10 years, and the ceiling rises with prior convictions or larger losses. Forums that advertise this trade are usually run by the same people who rob the buyers.
If you own or run a store, the useful version of this question is the opposite one: how does card data end up in a dump, and how do I keep mine out?
What CVV and CVC actually are
CVV, CVC, CVV2, and CVC2 all describe the same short code: three digits on the back of most cards, four on American Express, printed near the signature strip. It exists to prove the person typing the number is holding the physical card. The code is not written to the magnetic stripe or the chip in readable form, which is the whole point.
PCI DSS classifies that code as sensitive authentication data. Merchants may use it to authorize a transaction and then must not retain it, with no exceptions for "convenience" or "dispute protection." That single rule is why dumps have any value at all. Strip the code out of the equation and a stolen card number is far harder to spend online.
Why dumps get bundled and resold
A dump is only as good as its freshness. Banks kill compromised numbers fast, often within hours of a fraud report, so sellers push volume and urgency instead of quality. Buyers pay upfront, receive data that may already be dead, and have no recourse, because the transaction is itself a crime. I have read enough breach writeups to see the pattern repeat: the reseller profits twice, once from the sale and again from whatever the buyer exposes about themselves while paying.
What the law and the card networks do
Federal prosecutors treat carding as organized financial crime, not a prank. Charging documents routinely pair § 1029 with identity theft and wire fraud counts. On the private side, Visa and Mastercard push tokenization and step-up authentication, which replace the stored card number with a surrogate value that is useless outside one merchant or one device. Fraud teams also watch decline patterns in real time and flag merchants whose authorization traffic looks like automated testing.
If you run an online store
- Never persist the CVV, not in logs, not in a support ticket, not in a spreadsheet.
- Tokenize card numbers so your database holds surrogates instead of primary account numbers.
- Turn on 3-D Secure or another step-up challenge for high-risk orders.
- Watch for card testing: bursts of small declines from one IP block or one device fingerprint.
- Keep your checkout scripts and payment plugins patched, since skimming code is a common entry point.
Most card data leaks do not come from brilliant attacks. They come from a plugin nobody updated, a log file nobody cleaned, or a support agent who pasted a full card number into a chat window.
If someone tried to recruit you
Selling dumps is a felony with a paper trail, because every sale involves a payment, a handle, and a message history that investigators can subpoena from the platform hosting it. There is no version of this that ends with you keeping the money and staying clean. If you have already been contacted, stop responding and keep the messages. If you think your own card was compromised, report it to your issuer and to the FTC, then request a new number.