The direct answer

Nowhere legitimate. A CVV or CVC is the three or four digit verification code printed on a payment card, and it exists so a merchant can confirm that whoever is paying actually has the card in hand. There is no lawful marketplace, auction site, or broker for those codes. Every shop that advertises them is either trading stolen card data, which is a federal crime in the United States under 18 U.S.C. § 1029, or it is a scam aimed at the person trying to buy.

That answer holds whether you are asking because you stumbled onto card numbers you should not have, or because you want to understand the fraud economy so you can protect yourself. The second reason is the useful one, so the rest of this page is about that.

What the trade actually looks like

Card data moves in bulk, usually after a breach, a skimmer planted on a gas pump or ATM, or a phishing page that copied a real checkout form. Sellers trade in batches and lean on forum reputation scores to look trustworthy. The forums themselves are hidden, invite only, and watched. Investigators read them, undercover accounts sit in them, and takedowns happen in cycles. Anyone who buys or sells there is handing a record of their identity, wallet, and shipping details to strangers who are already breaking the law.

Why both sides usually lose

• Cards are often dead on arrival. Issuers kill a card within minutes of a suspicious charge, and fraud models flag the odd patterns that bulk card use produces.
• Escrow is the bait. The escrow service is usually run by the same people selling the data, and it disappears once a few buyers have funded it.
• Forums get seized. When that happens, account data, messages, and payment trails go with them.
• The paper trail is long. Card networks, banks, and shipping companies keep records that outlast any account ban.

How CVV data leaks in the first place

Most stolen codes come from familiar places: a skimmer on a fuel pump, a fake login page that looks like a bank, a small online store running outdated checkout software, or a merchant that stores the verification code in its database when it never should. Under the PCI Data Security Standard, a merchant may use the code to authorize a transaction but must not keep it afterward. If a site stores your CVV, that is a genuine red flag.

If your own card data is in circulation

You usually find out through a charge you do not recognize, a declined purchase, or a bank alert. When that happens, speed matters more than anything else.

• Check your statements line by line, not just the total. Small test charges often come first.
• Freeze or lock the card in your banking app while you sort it out.
• Ask for a new card number. A replacement card with the same number keeps the same risk.
• Turn on transaction alerts for every charge above a low threshold.
• Use virtual card numbers for subscriptions and unfamiliar sites so the real number stays out of circulation.
• Stop saving the card in every browser and shopping app. Each stored copy is one more place it can leak from.

A habit worth keeping

I treat my card number the way I treat my Social Security number. It goes to a merchant I chose, through a checkout I trust, and nowhere else. If a deal, a message, or a form asks for the CVV outside a checkout page, that is the moment to stop and walk away. Reporting fraud to your bank and to the FTC costs nothing and helps the next person.

The bottom line

There is no legal place to sell a CVV, and the illegal ones are built to rob everyone involved. If you are protecting your own card, the work is boring and effective: watch statements, lock the card fast, use virtual numbers, and never hand the code to anyone who asks for it outside a normal purchase.