There is no legitimate place to sell CVV or CVC codes. The three or four digit verification value is an anti-fraud check tied to a specific card, not a product, an asset, or a commodity. Every venue that advertises a market for CVV data is trading in stolen payment credentials, and both sides of that transaction break card network rules, PCI DSS obligations, and federal criminal law. The right criteria for judging any offer you receive about selling card verification data are simple: is the data yours to control, is the buyer authorized by the cardholder and the issuer, and does a regulated payment flow exist between the two. On all three, CVV resale fails.
Where to Sell CVV Legitimately
Why no legitimate market exists for CVV data
Card verification values are generated by the issuer and tied to the account, the card, and in some cases the check channel. They exist so a merchant can confirm that the person typing the number is holding the physical card. That purpose disappears the moment the value is copied, stored, or transferred to someone else.
- Ownership: the cardholder, issuing bank, and card network control the credential. A merchant receives it only to complete one authorization.
- Storage rules: PCI DSS prohibits retaining sensitive authentication data, including the CVV/CVC, after authorization. A business that keeps it is already out of compliance.
- No transferable value: unlike a license or a domain, a verification code has no lawful secondary buyer. Its only use outside your own checkout is fraud.
What the law says about buying or selling CVV codes
Federal law treats payment card numbers and their verification values as access devices. Trafficking in them, including buying, selling, transferring, or possessing them with intent to defraud, falls under 18 U.S.C. 1029. Penalties scale with the loss amount and the number of accounts involved, and courts routinely order restitution in addition to prison time. State statutes covering identity theft and unlawful use of a credit card run alongside the federal charge, so a single transaction can trigger cases in more than one jurisdiction.
There is also no safe harbor in the payment industry. Card networks can fine acquirers and merchants, terminate processing accounts, and place the business and its principals on terminated merchant lists that stay in place for years. No bank will knowingly open a merchant account for a company whose revenue comes from selling verification codes.
Legitimate ways to work with card security data
If your real interest is earning money from payment security expertise, the lawful paths are on the defense side. Two of the most common are worth comparing.
Network tokenization for stored credentials
Tokenization replaces the card number and the associated verification value with a surrogate that is useless if leaked, and the real credential never sits in your systems.
- Pros: removes card data from your environment, reduces PCI DSS scope, survives a database breach, and supports repeat billing without storing the CVV.
- Cons: requires integration work, depends on network and processor support, and adds a dependency on a third party for token lifecycle management.
Real-time CVV verification at the point of sale
Here the value is passed through to the issuer during authorization and never written to disk. This is the only correct handling for the code.
- Pros: low implementation cost, direct fraud signal for card not present orders, and clean PCI DSS posture when handled correctly.
- Cons: catches only some fraud, creates friction for legitimate customers, and provides no protection once the attacker has both the number and the code.
Use-case recommendation: use real-time verification on every checkout, and pair it with tokenization for any subscription or one-click flow. Never build a workflow that stores, exports, or shares the code itself.
How to spot a fake or criminal CVV marketplace
- It asks for payment in cryptocurrency or gift card codes with no invoice.
- It promises bulk files, BIN ranges, or "fresh" lists, which is a description of stolen data, not a product.
- It uses forum escrow, referral ranks, or screenshots of balances as proof of legitimacy.
- It has no registered business entity, no processing relationship, and no contract with a card network.
- Contact happens through encrypted chat apps after a first message on social media or a job board.
If your own card data may be for sale
- Call the number on the back of your card and report suspected compromise to the issuer.
- Freeze or replace the card, and change passwords on any account that stored it.
- Review statements for small test charges, which often precede larger ones.
- Place a fraud alert or security freeze with the major credit bureaus.
- File a report with the FTC and, if money was taken, with your local police.
- Report the marketplace or seller to the FBI Internet Crime Complaint Center.
Key takeaways
- No lawful marketplace sells CVV or CVC codes, and no legitimate buyer exists.
- Storing the verification value after authorization violates PCI DSS.
- Trafficking in card credentials is a federal crime with restitution and prison exposure.
- The legitimate career path is fraud prevention, tokenization, and payment security work, not resale.