Short answer: there is no legal place to sell a CVV
Selling a card verification value that belongs to someone else is not a gray area. In the US it falls under 18 U.S.C. § 1029, the access device fraud statute, and convictions carry prison time measured in years, not fines alone. Every venue that claims otherwise is one of three things: a criminal forum, a police operation, or a scam aimed at the person doing the selling.
Want to Sell CVV Data: It Is a Federal Crime in the US
So the honest answer is that the "market" people describe does not work the way it is advertised. Payment processors will not touch it. Banks will not touch it. And the people running it tend to rob each other.
What a CVV is, and why it matters
A CVV is the three digit code on the back of a Visa, Mastercard, or Discover card, and the four digit code on the front of an American Express. It exists to prove that whoever is typing the card number is holding the physical card. That is the whole point. It is a possession check, not an identity check.
When a merchant asks for the CVV during a card not present transaction, they are buying a small amount of assurance that the order is not being placed from a stolen number alone. That is why card data dumps often price numbers and codes separately, and why a number without the code is worth far less to a fraudster than one with it.
Why no legitimate platform lists CVVs
Think about what selling one would require. You would need a marketplace willing to accept inventory that cannot be verified as yours, from sellers who cannot be identified, for goods that are worthless the moment the real cardholder disputes the charge. No regulated business accepts that risk, and the card networks prohibit it by contract.
What actually happens to people who try
- Fake escrow services take the card data and never pay.
- Buyers dispute, reverse, or simply disappear after receiving the numbers.
- Undercover investigations run by federal agencies pose as buyers, and cases get built on chat logs and payment trails.
- Payment apps and crypto exchanges freeze accounts and file reports once fraud patterns appear.
Where the CVVs on the black market come from
Understanding the source is the most useful part of this for anyone who owns a card. Card data usually leaks through a handful of channels: skimmers placed on gas pumps and ATMs, phishing pages that copy a checkout screen, malicious scripts injected into a merchant's payment page, and large breaches at retailers or processors.
Small merchants get hit more often than people expect, because a compromised site can leak every checkout for weeks before anyone notices.
Keeping your own CVV out of circulation
- Never type your CVV into a page you reached from an email or text link. Open the merchant's site yourself.
- Use a virtual card number when your bank offers one. It limits the damage if the number leaks.
- Turn on transaction alerts. A charge you do not recognize is the fastest signal you will get.
- Cover the keypad, and check the card slot and the area around it before you use a pump or ATM.
- Give your CVV over the phone only when you placed the call and you know the business. Inbound callers asking for it are almost always fraud.
If your card data is already out there
Call the number on the back of the card and ask for a replacement. Under federal rules your liability for unauthorized charges is capped, and most issuers go further than the minimum, but the clock matters. Then review statements line by line for small test charges, since fraudsters often run a one dollar charge before a large one.
If your identity is exposed along with the card, report it at IdentityTheft.gov and consider a freeze with the credit bureaus. A police report helps if a merchant or issuer pushes back.
The bottom line
There is no lawful answer to where you can sell a CVV, and the illegal versions mostly end with the seller losing money, or getting charged. The useful question runs the other direction: how do you keep your own code from ending up in someone else's list. That one has real answers.