Short answer: there is no legal place to sell CVV numbers

Selling a CVV is illegal in the United States and in most other countries. A CVV is not a product you own, it is authentication data tied to another person's payment card. Offering it for sale counts as trafficking in access devices under 18 U.S.C. § 1029, and buying, listing, or brokering it carries the same criminal exposure.

Every website, forum, or chat channel that claims to sell CVVs is a scam, a law enforcement operation, or a criminal business that gets shut down. None of them are real marketplaces, and none of them can protect you.

What is a CVV, and why can't it be sold?

A CVV (card verification value) is the 3-digit code on the back of most cards, or the 4-digit code on the front of American Express cards. It exists for one purpose: to show that whoever typed the card details has the physical card in hand.

• The code belongs to the cardholder and the issuing bank. Possession of the digits does not transfer ownership.
• It is classified as sensitive authentication data under the PCI Data Security Standard.
• Merchants must delete it once a transaction authorizes. Keeping it is a compliance violation.
• A CVV alone is useless. It only works with the full card number, name, and expiration date, which is why sellers bundle stolen card records.

Because the code has no value on its own, any offer to sell one is really an offer to sell a stolen payment card. That is card fraud, plain and simple.

Why "CVV shops" and chat-channel sellers are traps

Search results for CVV marketplaces lead to a mix of fake storefronts, phishing pages, and criminal storefronts. Each one carries a different risk, and all of them end badly for the people who use them.

• Buyer scams: most "shops" take payment and never deliver, because the sellers know buyers cannot complain to anyone.
• Law enforcement monitoring: federal agents and card network investigators watch these channels, log activity, and build cases over months.
• Malware payloads: many listings hide credential stealers aimed at the buyer's own device and bank logins.
• Seizures: domains and accounts tied to card data sales get taken down and the records handed to prosecutors.

There is no way to list card data and stay anonymous. Payment trails, device fingerprints, and chat logs all survive attempts to hide them.

What happens to people who sell card data

Penalties under 18 U.S.C. § 1029 reach 15 years in prison and heavy fines, with higher exposure for repeat offenses and large-scale operations. Courts also order restitution to banks and cardholders for the full amount lost.

• Federal charges filed in the district where any part of the scheme touched a computer or a victim.
• Civil lawsuits from card issuers, processors, and merchants chasing chargeback losses.
• Asset forfeiture of bank accounts, crypto wallets, phones, and computers.
• A permanent criminal record that blocks most jobs involving money, logistics, or technology.

Card networks also blacklist merchant accounts linked to fraud, which shuts down any lawful business the person runs later.

If you want to sell online, here are lawful options

People searching for CVV sales often want a fast way to make money online. Real marketplaces do exist, and they do not require touching anyone else's card data.

• Resale of your own goods: eBay, Poshmark, Mercari, and Facebook Marketplace.
• Handmade and vintage items: Etsy and Shopify storefronts.
• Digital products: Gumroad, Ko-fi, and Payhip for templates, ebooks, and courses.
• Freelance services: Fiverr, Upwork, and Toptal for design, writing, code, and admin work.
• Payment processing: Stripe, Square, and PayPal handle card acceptance so you never store a CVV yourself.

Each of these routes uses CVV data at checkout for verification only. The code is checked, approved or declined, and then discarded.

How merchants should handle CVV data

If you run an online store, your job is to verify the code and then forget it. The PCI Data Security Standard bans storing CVV data after authorization, and card networks enforce that rule with fines.

• Step 1: Send the CVV with the authorization request through your payment gateway.
• Step 2: Store the approval result, never the code itself.
• Step 3: Use tokenization so repeat customers never re-enter raw card numbers on your servers.
• Step 4: Turn on 3D Secure or the card network's authentication service for high-risk orders.
• Step 5: Keep your checkout on PCI-compliant hosted fields or an iframe you do not control.

These steps cut chargebacks and keep your business out of fraud investigations.

How to keep your own CVV out of criminal hands

Card data ends up for sale after breaches, skimming, and phishing, not because the cardholder did something wrong. A few habits reduce the odds.

• Never read your CVV over the phone, by text, or by email to anyone who contacts you first.
• Use virtual card numbers from your issuer for subscriptions and unfamiliar sites.
• Check your statement each week, and read alerts from your bank the same day.
• Skip saving cards in browsers on shared or work devices.
• Freeze your card in your banking app if it goes missing, then order a replacement.

What to do if your card data shows up for sale

Act on the same day. The sooner the card is closed, the smaller the loss.

1. Call the number on the back of your card and report suspected fraud.
2. Ask for a new card number, not just a new card, so old authorizations fail.
3. Dispute every charge you do not recognize and keep the case numbers.
4. File a report at IdentityTheft.gov and, for card fraud, at IC3.gov.
5. Change passwords on shopping accounts and any site that stored the card.

Frequently asked questions

Is it legal to sell CVV numbers?

No. Selling CVV data is access device fraud under federal law in the US and a criminal offense in Canada, the UK, the EU, and most other jurisdictions.

Can I sell my own card's CVV to someone?

No. The code proves you hold the card, not that you own the data. Handing it over enables fraud, breaks your cardholder agreement, and can leave you liable for resulting charges.

What if I found a site selling CVVs?

Do not engage with it. Report the domain and any contact details to the FBI's Internet Crime Complaint Center and to the card network's fraud team.

What is the penalty for CVV trafficking?

Federal law allows up to 15 years in prison and fines, plus restitution. Sentences rise when the scheme involves many cards or organized groups.

Why do CVV checks exist at all?

They lower card-not-present fraud by confirming the buyer has the physical card. That protection only works when the code stays private.

The bottom line

There is no legal marketplace for CVV numbers, and the channels that pretend to be one exist to defraud buyers, cardholders, or both. If you want to sell online, pick a real platform and let your payment processor handle card verification for you.