Where Can I Sell a CVV? Nowhere Legitimate
There is no legal marketplace, broker, or forum where you can sell a CVV or CVC code. A card verification value is a security credential tied to someone's payment account, and offering it for sale in the United States falls under trafficking in unauthorized access devices, 18 U.S.C. 1029. That applies to the seller, the buyer, and anyone who hosts or processes the listing. Sites that claim to offer this service are almost always collecting payment details and identity documents from the people who use them, or they are run by researchers and law enforcement. If your actual goal is to earn money from card payments, the only lawful route is as a registered merchant or payment processor that transmits cardholder data with the cardholder's authorization through an acquiring bank. Everything else is a federal offense with a paper trail.
What the Three and Four Digit Codes Actually Are
The CVV, CVV2, CVC, or CID is a verification value printed on a card but never encoded in the magnetic stripe or the EMV chip. It exists to prove that whoever typed the number is holding the physical card. Because it is not stored on the card's chip, it cannot be skimmed from a terminal the way track data can. That is also why it is the single most valuable piece of a card record to a fraudster, and why PCI DSS treats it as Sensitive Authentication Data with the strictest handling rules of any data element on the card.
Why Selling Card Data Is a Federal Crime
Under 18 U.S.C. 1029, producing, selling, transferring, or possessing unauthorized access devices with intent to defraud carries up to 10 years in prison for a first offense and up to 15 years for aggravated offenses involving large volumes or organized activity. Civil liability runs in parallel, and card networks pursue their own actions against anyone caught monetizing stolen account data. A conviction also means restitution to issuers and cardholders, which in carding cases routinely exceeds any money the seller ever received.
How CVV Data Leaves a Cardholder's Hands
- Skimming or shimming at a fuel pump, ATM, or unattended terminal.
- Phishing pages and fake checkout screens that copy form fields in real time.
- Merchant-side breaches where an attacker reaches unencrypted authorization traffic or improperly stored data.
- Social engineering calls and texts that ask the cardholder to read the code aloud.
- Malware on a consumer device that captures keystrokes during checkout.
What to Look For If You Handle Card Data
Merchants and developers should judge any processor or gateway by how it treats Sensitive Authentication Data, not by its marketing copy. Ask for the current Attestation of Compliance, confirm the version of PCI DSS in scope, and check whether authorization traffic is encrypted end to end. A processor that offers to store CVV codes for convenience, recurring billing, or chargeback defense is out of compliance and should be disqualified on that fact alone.
Parameter Bands to Use as a Baseline
- Length: 3 digits for Visa, Mastercard, Discover, and UnionPay, 4 digits for American Express (CID).
- Storage window: zero. PCI DSS v4.0 Requirement 3.3.1 prohibits retaining Sensitive Authentication Data after authorization, even in encrypted form.
- Transmission: TLS 1.2 or higher for all cardholder data in transit.
- External vulnerability scans: quarterly by an approved scanning vendor under Requirement 11.3.1.
- Penetration testing: at least annually and after significant infrastructure changes under Requirement 11.4.1.
- Log retention: 12 months, with the most recent 3 months immediately available under Requirement 10.5.1.
Pitfalls That Cost People Money
- Deposit or escrow demands. Any site that requires a crypto deposit before you can list or buy card data is running the scam on you.
- Verification uploads. Requests for a government ID or selfie are identity theft attempts, not fraud prevention.
- Test charges. Small authorization attempts against a card you control are how stolen numbers get validated, and they are evidence of intent.
- Job offers. Roles advertised as payment testing or chargeback analysis frequently ask new hires to move card data, which shifts criminal liability onto them.
- Consumer code sharing. Reading a code to an inbound caller who claims to be your bank or a retailer hands over the last barrier on the card.
FAQ
Is there any legal site to sell a CVV?
No. There is no licensed exchange, auction, or broker for card verification values in the United States or any other jurisdiction with functioning card fraud law.
Can I sell the CVV of my own card?
You cannot sell the code itself. If you want to receive money from your own card account, do it through a merchant account, a payment app, or an issuer cash advance, all of which authorize the transaction under your identity.
What happens if someone asks for my CVV by phone or email?
Do not provide it. A legitimate bank, processor, or retailer never needs the code read aloud, and requests for it are the defining feature of card draining scams.
How should a business store CVV for recurring payments?
It should not. Recurring billing uses a token or a stored credential framework with the issuer, never the printed verification value.