There is no legitimate place to sell a CVV online. A CVV is the three or four digit security code printed on a payment card, and it exists to prove that the person using the card is holding the physical card. Selling that code, or buying one, is card fraud under U.S. law. Forums and vendors that advertise CVV sales are not marketplaces. They are either scam operations that take your money and vanish, or criminal storefronts that law enforcement monitors.

What a CVV actually is

The CVV (also printed as CVC, CVV2, or CVC2) is a check digit that card issuers generate from the account number and other data. It is not a password, and it is not transferable. It only means something when paired with the card number, expiration date, and cardholder name in a single transaction. Strip away the cardholder and the code is a string of digits with no owner you can lawfully sell it for.

Why no legal marketplace exists

Card network rules and the PCI Data Security Standard forbid anyone from storing the CVV after a transaction is authorized. That means the merchant who took the card has no right to keep the code, let alone resell it. A third party offering CVVs for sale therefore has no lawful path to hold the data in the first place. Every listing is either stolen card data or invented data used to bait a buyer.

What happens to people who sell card data

U.S. federal prosecutors charge CVV trading as access device fraud and aggravated identity theft. Sentences for aggravated identity theft run in two-year mandatory increments stacked on top of the underlying fraud count. Buyers get charged too. Payment processors flag accounts tied to card-testing patterns, and banks close them.

If you run a store and need to accept cards

  1. Open a merchant account with a bank or a payment processor that handles card acceptance.
  2. Use the processor's hosted checkout page so card numbers and CVVs never touch your servers.
  3. Turn on address verification and CVV verification in the processor's fraud settings.
  4. Keep your PCI DSS self-assessment questionnaire on file and repeat it each year.
  5. Route chargebacks and disputes through the processor's formal response process instead of contacting cardholders directly.

If someone asked you to sell or buy CVVs

  1. Stop the conversation and do not send money, card images, or card numbers.
  2. Save the messages, usernames, and payment details.
  3. Report the contact to the FBI Internet Crime Complaint Center and to the FTC.
  4. If your own card data was exposed in the exchange, call the card issuer and ask for a replacement card with a new number and CVV.
  5. Place a freeze on your credit files with all three bureaus if you shared identity details as well.

If your own CVV was exposed

  1. Call the number on the back of your card and report the exposure.
  2. Request a new card number and a new CVV rather than a reissue of the same number.
  3. Review statements for small test charges, which are the usual first sign of card testing.
  4. Dispute any charge you do not recognize in writing through the issuer.

What to do instead with card security skills

Legitimate work in this field is on the defense side: fraud analyst, chargeback specialist, PCI compliance coordinator, or payment operations engineer. Those roles pay real salaries, and none of them require touching a stolen code.