The short answer: there is no legitimate way to sell a CVV or CVC number, and Reddit is not a marketplace for it. Anyone posting that they want to buy card verification values is either running a scam, harvesting your data, or working with investigators. Selling card data is carding, a federal offense in the United States under 18 U.S.C. § 1029, and it carries prison time whether you stole the number yourself or just passed it along. If you are being pressured into it, or you are curious because someone offered you money, the right move is to walk away and report it.
What people actually mean by "selling CVVs"
A CVV2 or CVC2 is the three or four digit code printed on the back of a Visa or Mastercard, or the four digits on the front of an American Express. It exists for one reason: to prove the person typing the card number physically holds the card. Card networks and the PCI Security Standards Council require merchants to never store that code after a transaction authorizes, precisely so it cannot be resold or reused.
When a forum post talks about "selling CVVs," it usually means one of three things:
- Selling stolen card numbers plus the verification code, which is the raw material for card-not-present fraud.
- Selling a "method" or "tutorial," which is almost always a paid scam aimed at people who want quick money.
- Selling access to a cashout service, which is another layer of fraud and another layer of people who will disappear with your money.
None of these are grey areas. All of them are crimes.
Why the Reddit buyers are not real buyers
I have read enough of these threads to see the pattern. The person offering to buy your CVV wants one of a few things.
- Your card, not your product. They ask for a "test" charge or a screenshot of the card. That is the whole point. You get nothing.
- Your identity. Cashout channels require a bank account, a payment app, or a crypto wallet. Once you send funds or receive them, your name is on the transaction trail.
- A fall guy. Fraud rings recruit people to receive money or ship goods. When the chargebacks land, the recruited person is the one with a name, an address, and a bank account.
- Evidence. Some of those accounts belong to people building cases. The Internet Crime Complaint Center at ic3.gov exists because these operations get reported, and chat logs are evidence.
Reddit itself bans this activity. Subreddits get shut down, accounts get suspended, and the scams move to the next throwaway handle. The offer never gets better, only more urgent.
The legal reality, plainly
Under federal law, trafficking in unauthorized access devices covers selling, transferring, and even possessing card numbers with intent to defraud. Penalties scale with the amount involved and can reach 10 to 15 years for aggravated cases, plus restitution. State laws add their own charges for identity theft and larceny. Being 17, being broke, or being told "it's not really stealing" changes nothing about how a prosecutor reads it.
There is also a civil side. Banks pursue cardholders and account holders for losses, and payment apps will freeze and claw back funds. That happens before any criminal charge.
If someone offered you money for your card details
Do not send anything. Not a photo, not a screenshot of your banking app, not a "test" payment to a stranger. If the person contacted you through a game, a Discord server, or a job ad, that is a recruitment pattern the FTC has warned about for years: fake jobs that use your bank account to move stolen money.
Report it. The FTC takes reports at ReportFraud.ftc.gov, and the FBI's IC3 takes card fraud complaints. If your own card data was exposed, contact your issuer immediately. Under the Fair Credit Reporting Act you are not liable for unauthorized charges, and the CFPB explains how to dispute them.
How to keep your own CVV safe while shopping online
- Only enter the code on a site with HTTPS and a checkout you reached by typing the address yourself, not by clicking an ad.
- Never send a photo of your card to anyone, including someone claiming to be from your bank. No legitimate bank asks for that.
- Use a virtual card number from your issuer for subscriptions and unfamiliar merchants. It generates a separate code you can burn.
- Turn on transaction alerts so a test charge shows up in seconds.
- Check your statements weekly rather than monthly. Small charges are how card testing hides.
What to do if your card number is already out there
Call the number on the back of your card and ask for a new number, not just a new card. Freeze your credit at all three bureaus. Change the password on any account that stored the card, and turn on two-factor authentication. Then file a report so the pattern gets counted.
The search that brought you here usually ends one of two ways: someone loses money, or someone stops and reports it. The second option is the only one with a good ending.