The short answer
There is no legal place to sell CVV dumps. A dump is card data copied without the cardholder's permission, and trafficking in it is access device fraud under 18 U.S.C. 1029, a felony that carries prison time and restitution in the United States. The forums and chat channels that advertise this trade are also the ones most heavily watched by card networks, banks, and law enforcement, and the data sold there is frequently expired, recycled, or already flagged. If you found card data that does not belong to you, the lawful options are to report it to the issuing bank, to the FBI's Internet Crime Complaint Center, or to the FTC. If you are reading this because you want your own card to stay out of those markets, the sections below cover what actually protects a CVC during an online purchase.
How to Safely Sell CVV Dumps in 2024
What the CVC is, and why it is a target
The three or four digit code printed on a card, called CVV2, CVC2, or CID depending on the network, exists to show that whoever is typing the number is holding the physical card. It is kept out of the magnetic stripe and chip data, and PCI DSS forbids merchants from storing it after a transaction is authorized. That is exactly why it is a target. A stolen card number alone can be blocked by an address check or a one-time code. A card number plus a valid CVC can be run as a card-not-present transaction at a merchant that does not require additional verification.
Best Way to Sell CVV Dumps in 2024
How card data reaches a resale market
- Skimming hardware and overlays placed on fuel pumps, ATMs, and unattended terminals.
- Web skimming scripts injected into a checkout page, often called formjacking.
- Phishing pages and fake order confirmation emails that ask the buyer to re-enter payment details.
- Data breaches at merchants or processors where card data was not properly encrypted.
- Malware on a consumer device that captures keystrokes at checkout.
What real CVC protection looks like at checkout
For a cardholder, the strongest controls are the ones that remove the static CVC from the transaction. Virtual card numbers generate a unique card number and code for one merchant or one subscription, so a leak at that merchant cannot be reused elsewhere. Network tokenization replaces the card number with a token that only works in a specific payment context. 3D Secure, the step-up screen from Visa, Mastercard, or American Express, adds a bank-verified challenge that a dump alone cannot satisfy. Spend alerts and per-transaction limits do not stop the first fraudulent charge, but they surface it within minutes instead of on a monthly statement.
Is Selling CVV Dumps Legal in 2024? The Law Explained
Signals that a merchant handles card data well
- The checkout page is served entirely over HTTPS and the payment fields are hosted by a processor rather than the merchant's own domain.
- The site does not ask you to email, text, or read your CVC over the phone.
- Saved cards appear as a token or a last-four reference, not as a full number plus code.
- Large orders trigger a step-up authentication challenge instead of completing silently.
Common pitfalls
- Assuming a small or unfamiliar shop is safer than a large one. Breach risk follows how data is stored, not how the store looks.
- Reusing a card number across many sites. One compromised checkout exposes every saved profile that shares the number.
- Ignoring small test charges. Fraudsters often validate a card with a dollar or two before a large purchase.
- Believing that a CVC check makes a transaction safe. It verifies possession of the card data, not the identity of the person using it.
FAQ
Is selling CVV dumps legal anywhere in the United States?
No. Trafficking in unauthorized access devices is a federal offense, and state laws add their own penalties. There is no licensed or regulated market for it.
What should I do if I find stolen card data?
Do not use, copy, or forward it. Report the find to the card issuer named on the data if it is visible, and file a complaint with the FBI's Internet Crime Complaint Center or the FTC.
My card was used without my CVC. How is that possible?
Some merchants and recurring billing setups process transactions without a CVC check, and some fraud uses card numbers obtained alongside the code. Report the charge to your issuer, and the card will be reissued with a new number and code.
Does a virtual card number stop dump-based fraud?
It limits the damage. A number locked to one merchant and one spending limit cannot be resold as a general purpose dump, though it can still be abused at the merchant it was created for.