You cannot legally sell CVV or CVC numbers online, and there is no legitimate market where you can. A CVV is a security code issued with a specific payment card, so it belongs to the cardholder and the issuing bank, not to whoever holds the number. People who want to sell CVV online are describing carding, a form of access device fraud that US federal law treats as a serious crime.
What a CVV Actually Is
The card verification value is a short numeric code printed or generated alongside a payment card. It exists to prove that whoever is entering the card number physically holds the card or has authorized access to the account.
Buying Guide: How to Choose the Best CVV Shop for Online Purchases
- Visa, Mastercard, and Discover use a three digit code on the back of the card.
- American Express uses a four digit code on the front.
- Some issuers generate a fresh code for each online transaction through a mobile app or digital wallet.
Merchants are not allowed to store the CVV after a transaction is authorized. That rule exists because the code is valuable to criminals and useless for legitimate record keeping.
Why Selling CVV Data Is Illegal
Trafficking in card codes falls under federal access device fraud, 18 U.S.C. § 1029, and often wire fraud, 18 U.S.C. § 1343, because offers travel across state lines through the internet. Selling, transferring, or possessing card data with intent to defraud is covered by those statutes. Penalties can include prison time, fines, restitution to victims, and a criminal record that follows you into background checks, loan applications, and job offers.
Beyond criminal exposure, buyers and sellers of stolen card data are frequent targets of each other. Carding markets are full of fake codes, exit scams, and law enforcement monitoring. A person who tries to sell CVV online often ends up either cheated, arrested, or both.
How Card Data Ends Up for Sale
Card codes do not appear from nowhere. They usually come from:
- Phishing pages and fake checkout screens that copy what you type.
- Skimming devices and shimmers placed on gas pumps and ATMs.
- Data breaches at merchants or processors that failed to protect stored information.
- Social engineering calls where someone poses as a bank fraud department.
Each of those methods harms a real person who then has to dispute charges, replace a card, and repair credit damage. That harm is why the law and the card networks treat the trade so harshly.
If Someone Asks You to Sell or Share CVVs
- Refuse and stop responding. Do not send a test code to prove anything.
- Save the messages, usernames, and payment details you were given.
- Report the contact to the FBI Internet Crime Complaint Center and to the card issuer whose codes were mentioned.
- If the request came through a platform, report the account to that platform.
- If you were tricked into participating, talk to a lawyer before you talk to anyone else.
Legitimate Ways to Work With Card Data
There are legal paths if your interest is payments, security, or research.
- Merchants can accept cards through a PCI DSS compliant processor that handles the sensitive data for them.
- Developers can use tokenization, where a random token replaces the card number in your systems.
- Security researchers can test with published test card numbers from processors or join an authorized bug bounty program with a written scope.
- Anyone building a payment product should follow PCI DSS rules, which prohibit retaining CVV data after authorization.
How to Protect Your Own CVV
- Never type your code into a page you reached from an email, text, or ad.
- Use a virtual card number from your issuer for subscriptions and unfamiliar sites.
- Cover the back of your card when others can see it, and avoid reading the code aloud on calls.
- Check statements often and report unknown charges right away.
If you searched because you want to sell CVV online, the practical answer is that the money is a trap and the activity is easy to trace. Protecting card data, reporting fraud, and working through licensed payment channels are the only routes that do not end in a charge, a lawsuit, or a closed account.