There is no legitimate place to sell a CVV. The card verification value is a security code issued by a bank and bound to a specific payment card, and selling, buying, or brokering one is card fraud under US federal law and the laws of every major payments market. Any site, forum, or chat channel that advertises “legit CVV” sales is a scam, a criminal marketplace, or a law enforcement operation.
Why is there no legitimate market for CVVs?
The CVV exists to prove the physical card is present or that the cardholder holds the card. It is generated by the issuing bank and validated by the issuer during authorization. A merchant that stores CVVs after authorization violates PCI DSS, so no compliant business holds a stock of CVVs to resell.
Where to Sell CVV With Bitcoin: No Legitimate Marketplace Exists
Cardholders also cannot transfer a CVV the way they can transfer a gift card. The code belongs to the issuing bank and the payment network, not to the person holding the plastic. Selling it is not a sale of property. It is the disclosure of an authentication secret used to commit fraud.
Sell CVV to a Legit Shop? No, It Is Card Fraud
What actually happens on sites that claim to sell CVVs legitimately?
Listings marketed as “fresh,” “high balance,” or “verified” are recycled or fabricated data. Buyers who send cryptocurrency receive nothing usable, or receive numbers that were already blocked by the issuer. The operator keeps the deposit and moves to a new domain.
- Exit scams: storefronts that collect payment and close within days.
- Malware delivery: “free sample” archives that install credential stealers on the buyer's machine.
- Sting operations: platforms run by investigators to identify buyers and sellers.
- Card testing fallout: stolen numbers used to probe weak checkout systems, which then flag the merchant.
What are the legal consequences of selling CVV data?
In the United States, 18 U.S.C. § 1029 criminalizes trafficking in unauthorized access devices, which covers card account numbers and their verification codes. A first offense carries up to 15 years in prison plus fines, and conspiracy charges can apply to anyone who helps move the data.
Most states add their own identity theft and computer crime statutes. Outside the US, the UK Fraud Act 2006 and similar laws across the EU and Asia treat the sale of card data as a serious offense with custodial sentences.
Which legitimate activities involve handling CVV data?
Real work with verification codes happens inside regulated environments with written authorization. Examples include PCI DSS compliance audits, tokenization and network token deployment, and contact center systems that mask keypad entries so agents never hear or see the code.
Security researchers test payment flows under a signed scope of work and a sandbox. They do not buy or sell live card data, and they do not publish working numbers.
How should you respond to an offer to buy or sell a CVV?
Do not engage, do not send a sample, and do not accept a “test” transaction. Document the message and report it to the FTC at reportfraud.ftc.gov, the FBI's Internet Crime Complaint Center, and the fraud line of the card issuer involved.
If your own card data was exposed, request a replacement card with a new number and code, and review recent statements for small authorization probes.
Frequently asked questions
Can I sell the CVV of my own card?
No legitimate buyer exists for your own card data. Anyone offering money for it is setting up an account takeover or advance-fee scam, and the card will be used for fraudulent purchases that trace back to you.
Are CVV shops legal in any country?
No jurisdiction authorizes trading stolen payment card data. Some markets have weak enforcement, but the activity remains a crime, and cross-border card networks cooperate with investigators on takedowns.
Is selling a gift card the same as selling a CVV?
No. Gift cards carry no card verification value and no linked credit line, so resale is generally lawful. Selling a credit or debit card together with its printed code violates the cardholder agreement and enables fraud.
Why do some merchants ask for the CVV on the phone?
Phone orders may collect the code for a single authorization, but PCI DSS requires that it never be written down or stored afterward. Reputable call centers use pause-and-resume recording and keypad masking to keep the code out of logs.