There is no legal place to sell CVV or CVC codes. Selling, buying, or brokering card verification values is card fraud, prosecuted in the United States under 18 U.S.C. § 1029 and under equivalent statutes in most countries. Every site, forum, or private channel that advertises CVV sales is a criminal operation, and a large share of them are scams that take the buyer's money and vanish.
Where do people look for CVV marketplaces?
Searches for this topic usually come from three groups: fraud operators, curious researchers, and people who misunderstand what a CVV actually is. None of them will find a legitimate seller, because no card network, bank, or payment processor authorizes the sale of verification codes. The only results are closed storefronts, hijacked forums, and fake shops built to collect cryptocurrency and buyer identities.
What is a CVV or CVC code?
A CVV, CVC, or CVV2 is the three or four digit code printed on a payment card. It proves the person entering the card number physically holds the card, which is why online merchants request it at checkout. The code is not written into the magnetic stripe or the chip, and card networks prohibit merchants from keeping it after a transaction is authorized.
Why can't CVV codes be sold like other data?
Card verification values are generated by the issuing bank and tied to one specific account. They are not a product, a license, or a transferable asset. Because possession of the code is the security control itself, handing it to a third party defeats the control and is treated as unauthorized access device trafficking.
Why CVV marketplaces are illegal
- Trafficking in card numbers, CVVs, and full card data is a federal crime in the US, carrying penalties of up to 10 years per count.
- Knowingly buying the data carries the same legal exposure as selling it.
- Banks, card networks, and processors terminate any merchant account tied to carding activity.
- Shops that advertise CVV sales often harvest buyer details and resell them to other criminals.
What happens to buyers and sellers?
Law enforcement tracks carding marketplaces through undercover operations, seized servers, and blockchain analysis of payouts. Arrests and convictions for card fraud are routine in the US, UK, and EU. Victims of CVV shops typically lose their money and their personal data at the same time.
Legal alternatives if you want to sell online
Merchants who want to accept card payments open a merchant account through a bank or payment processor. That process requires identity verification, a registered business, and PCI DSS compliance. Once approved, you can sell products and services without ever touching a customer's CVV.
Do you ever need to store a CVV?
No. PCI DSS Requirement 3.2 forbids storing sensitive authentication data, including the CVV, after authorization. Tokenization and recurring billing flags handle repeat payments instead, so the code never rests in your systems.
If you are a security researcher
Researchers who study card fraud work through authorized channels. Bug bounty programs, university ethics boards, and vendor disclosure agreements provide legal cover for testing payment systems. Purchasing live card data, even for research purposes, falls outside those agreements and remains a criminal act.
How shoppers can protect their CVV
- Enter your CVV only on a checkout page that uses HTTPS and a recognizable payment form.
- Never send a CVV by email, text, or chat, even to someone claiming to be your bank.
- Use virtual card numbers from your issuer when shopping with an unfamiliar merchant.
- Review statements and dispute unknown charges within 60 days.
Key takeaway
There is no legitimate buyer, seller, or broker for card verification values anywhere. Anyone offering to sell you CVV data is committing a felony and is likely targeting you as the next victim.