There is no legal place to sell CVV fullz. Every site, forum, and chat channel that trades card data operates outside the law. In the US, selling a card number, a CVV, or a full identity record is a federal offense. The market exists, but it is a criminal one, and its participants face prison, fines, and restitution.
What the terms mean
A CVV is the 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. Issuers generate the code to prove the buyer holds the physical card.
"Fullz" is slang for a bundle. It pairs a card number with the holder's name, billing address, phone number, date of birth, and Social Security number. Some bundles add bank login credentials. Sellers charge more for fullz than for a card number alone because the extra fields support new account fraud and tax fraud, not one purchase.
The law
18 U.S.C. § 1029 covers fraud and trafficking in access devices. A card number, a CVV, and an account password all count as access devices. Penalties scale with the number of devices and with prior convictions. Related charges include wire fraud under 18 U.S.C. § 1343, identity theft under 18 U.S.C. § 1028, and state statutes in all 50 states.
- Selling card data: federal felony.
- Buying card data: federal felony.
- Possessing 15 or more access devices with intent to defraud: separate charge under § 1029(a)(3).
Where card data does move
Legitimate payment networks do not sell card data. Processors pass transaction details to issuers for authorization, then discard the CVV. PCI DSS Requirement 3 bars storage of sensitive authentication data after authorization. Merchants replace the real card number with a token so a breach cannot expose it.
If your card or identity was exposed
- Call the issuer and ask for a new card number.
- Place a free credit freeze with Equifax, Experian, and TransUnion.
- File a report at IdentityTheft.gov, the FTC identity theft site.
- File a police report. Banks and insurers ask for one.
- Read card statements and credit reports for accounts you did not open.
What happens to sellers
The FBI and the Justice Department announce carding indictments each year. Convicted sellers receive prison terms, forfeiture of computers and crypto, and restitution orders. Card networks and processors close merchant accounts tied to card data sales.
Bottom line
No licensed marketplace, bank, exchange, or broker deals in CVV fullz. Any offer to sell or buy them is a crime in the US and in most other countries. Report the offer to the FBI Internet Crime Complaint Center.