Short answer
There is no legitimate place to sell a CVV. A CVV belongs to a payment card account. It belongs to the cardholder and the issuing bank. Selling a CVV means selling access to someone else's account. In the United States that is a federal crime under 18 U.S.C. § 1029. Sites that advertise CVV sales are not legal marketplaces. They are data trafficking operations or scams that collect payment and deliver nothing.
What a CVV is
A CVV is a 3 or 4 digit code. Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. The code proves the person entering the card number holds the physical card. The card networks classify it as sensitive authentication data.
Why resale is illegal
18 U.S.C. § 1029 covers access devices. A card number, a CVV, and a magnetic stripe record all qualify. The statute bans producing, trafficking, and using these devices. Convictions carry fines and prison terms with maximums of 10 to 20 years, set by the count and the dollar value.
What "CVV shops" are
Underground markets sell card records in bulk. Buyers often receive data that is dead, duplicated, or invented. Sellers on those sites face charges for trafficking. Buyers face charges for fraud and for using a counterfeit access device. Both sides lose money and face prosecution.
If you work with card data
Merchants handle CVVs during checkout. They do not sell them. PCI DSS Requirement 3.2 forbids storing sensitive authentication data after authorization. Tokenization and processor-hosted fields keep the code out of merchant systems. Data that never reaches a database cannot be sold or leaked.
Where to report
File a complaint with the FBI Internet Crime Complaint Center at ic3.gov. Report payment card fraud at IdentityTheft.gov, operated by the FTC. Cardholders can also call the number on the back of the card and ask for the fraud unit. Banks can reverse charges and reissue the card.