Short answer: there is no legal market for selling CVV data
If your search is want to sell cvv for money, the honest answer is that selling card verification values, full card numbers, or any payment credential you did not issue is a federal crime in the United States, not a side hustle. Under 18 U.S.C. Section 1029, trafficking in unauthorized access devices covers this activity directly, and convictions carry prison time, mandatory restitution, and supervised release. Holding the data with intent to sell, or arranging a sale that never closes, is enough for charges. The people who profit in this space are rarely the sellers. They are the brokers and the cash out operators who keep the proceeds and leave you holding the evidence. If card data has landed in your hands, the safe move is to report it. The durable income in this field comes from legitimate security work.
What the law actually covers
Card fraud is prosecuted on several tracks at once. Knowing the labels helps you understand why the money pitch is a trap rather than a plan.
Access device fraud
An access device is any card number, account number, CVV, PIN, or token that can be used to obtain money or goods. Producing, selling, transferring, or possessing these with intent to defraud falls under 18 U.S.C. Section 1029. Penalties scale with the number of devices and the dollar loss, and the statute reaches attempts and conspiracies, so an unfinished deal still counts.
Charges that stack
- Identity theft and aggravated identity theft, which can add a mandatory consecutive term when the crime involves another person's means of identification.
- Wire fraud and bank fraud, which apply to the transfers and payouts that follow a sale.
- Computer fraud where credentials came from breaches, skimmers, or phishing kit logs.
- Money laundering where proceeds move through crypto, gift cards, or mule accounts.
Beyond criminal exposure, card issuers and networks can pursue civil claims, and courts order restitution to victims. A single buyer who turns out to be law enforcement ends the entire arrangement.
How the easy money pitch works against you
The offer usually arrives through a chat app, a forum post, or a direct message from someone who claims to have buyers waiting. The structure is similar across cases.
- You are asked for a sample batch to prove the data is live, which is an unrecoverable loss of the only asset you had.
- You are told to pay an escrow, verification, or activation fee to release payment.
- You are asked to receive and forward funds, which converts you from a data seller into a money mule with a longer sentence.
- Payment is promised in crypto that either never arrives or is traced back to the sending wallet.
Each step moves risk onto you while the counterparty keeps the upside. Sellers in these schemes are also targets of theft by other participants, and there is no recourse when a deal goes bad because the underlying contract is illegal and unenforceable.
Risk bands: what exposure looks like
Sentencing depends on the number of access devices, the loss amount, whether the conduct was organized, and whether identity theft applies. As a rough framing, not legal advice:
- Low volume, no distribution: felony exposure with fines, probation or prison, and restitution to issuers.
- Any sale or transfer to another person: trafficking enhancement, longer guideline range, possible consecutive identity theft term.
- Batch sales plus cash out: multiple counts, money laundering exposure, asset forfeiture of accounts and devices.
- Cross border transfers: extradition risk and prosecution in more than one jurisdiction.
For reference, PCI DSS prohibits merchants and processors from storing the CVV2 or CVC2 value after authorization, which is why any CVV offered for sale was obtained outside legitimate payment flows. That fact alone signals unlawful origin.
Legitimate work that pays in this field
Card security is a real career track with steady demand. Fraud analyst, chargeback specialist, trust and safety investigator, payment risk engineer, and PCI compliance auditor roles all use the same subject matter knowledge without the criminal record. Certifications in fraud examination and security awareness training are widely recognized, and employers in banking, retail, and payment processing hire continuously. Reporting a scam or a data exposure to the FBI Internet Crime Complaint Center or the FTC also creates a documented record that can help victims recover.
FAQ
Is selling only a few cards a misdemeanor?
Access device offenses are charged as felonies in federal court. Volume affects the sentence, not whether the conduct is criminal.
What if I did not know the cards were stolen?
Intent is proven from circumstances such as how the data was obtained, how it was advertised, and how payment was arranged. Willful blindness does not shield a defendant.
Can I just delete the data and move on?
Deleting records does not undo possession or distribution that already occurred, and destruction of evidence can add obstruction charges. Consulting a defense attorney is the appropriate step if you have already been contacted.
Where do merchants get CVV data legitimately?
They do not store it. The value is passed to the issuer during authorization and then discarded, in line with PCI DSS requirements.