Short answer
There is no legitimate place to sell CVV or CVC data. A CVV is the 3-digit or 4-digit security code printed on a payment card. It belongs to the cardholder and the issuing bank. Selling it, buying it, or trading it is a federal crime in the United States under 18 U.S.C. § 1029, which covers fraud and related activity in connection with access devices.
Any site that markets itself as a "legit CVV shop" is a fraud market. Buyers and sellers on those sites commit access device fraud and identity theft.
Guide to Finding a Reliable CVV Selling Platform
What CVV listings contain
A typical listing pairs a card number with a CVV, an expiration date, a cardholder name, and a billing ZIP. That bundle is a stolen payment record. Prices run from about $5 for a low-balance card to $60 or more for a card with a high credit line. Sellers use forums, Telegram channels, and invite-only markets. None of them are legal.
Why a scam-free market cannot exist
Every CVV market carries three risks that cannot be removed.
- Exit scams. Operators take deposits and close the site. Buyers have no legal recourse because the transaction itself is a crime.
- Law enforcement seizures. The FBI, Europol, and the U.S. Secret Service have taken down multiple carding forums and indicted their administrators.
- Data quality. Card issuers void cards within hours of a fraud report, so bought records stop working fast.
A buyer who is cheated on a carding site cannot report the theft. A seller cannot enforce a deal. That is why the search for a "safe" CVV market has no endpoint.
Penalties under 18 U.S.C. § 1029
Federal penalties for access device fraud reach 10 years in prison per count. Trafficking offenses and cases tied to organized crime carry up to 15 or 20 years. Courts can add fines and restitution. A single card number with a CVV can support a charge.
If you run a store
You do not need to sell card data. You need a payment processor and a merchant account. PCI DSS Requirement 3.2 prohibits storing sensitive authentication data, including the CVV, after authorization. Tokenization replaces the card number with a token, so your systems never hold the code.
If someone offers to buy card data from you
That is a solicitation to commit a crime. Report it to the FBI Internet Crime Complaint Center. Keep the messages and account details.
If your own CVV was exposed
- Lock the card in your bank app or call the number on the back.
- Request a new card number. A new CVV comes with it.
- Read 12 months of statements and dispute charges you do not recognize.
- File a report at IdentityTheft.gov and place a freeze with Equifax, Experian, and TransUnion.
Unknown: the exact number of active carding sites. Operators rotate domains, so counts change week to week.