Stolen CVV data gets traded on dark web carding forums, invite-only chat channels, and automated shop bots, and every one of those venues is a criminal operation. Selling, buying, or holding a stolen card verification value is card fraud under 18 U.S.C. § 1029 in the United States. There is no legal place to sell a CVV, and the sites that advertise one are often run by scammers who take the payment and deliver nothing.
What sellers mean by "CVV" in a dark web listing
On a real payment card, the CVV is the three-digit code printed on the back of a Visa or Mastercard, or the four-digit code on the front of an American Express. It exists for one reason: to prove the person typing the number has the plastic in hand.
Carding forums borrow the same three letters as shorthand for a full stolen record: card number, expiry, cardholder name, billing address, and the code itself. A "CVV shop" sells those records in batches, priced by card type, issuing country, and bank.
Why the label is marketing
A record sold as "fresh CVV" is a stolen card account. The wording makes it sound like a data product instead of a stolen financial credential, which is what it is under the law.
Why the CVV exists in the first place
Card networks added the printed verification code to cut down on card-not-present fraud, the kind of fraud where nobody swipes or taps anything. The idea was simple: a thief with a copied card number still would not know the three digits on the back.
That defense works only when merchants actually ask for the code. A checkout that skips the CVV field removes the check and makes a stolen number as good as a card.
How these marketplaces operate, and why they collapse
Carding sites follow a pattern: a public forum for reputation and tutorials, a private shop for transactions, and a chat channel for support. Access usually needs an invite or a crypto deposit.
They also disappear. Law enforcement seizes domains in cycles, and operators exit with user balances before a takedown arrives. Trust between criminals is the weak point.
- Escrow services that vanish with the balance
- "Checker" tools that log the card data they validate
- The same record resold to several buyers
- Exit scams timed to a large deposit
What the law says about selling CVV data
18 U.S.C. § 1029 makes it a federal crime to produce, sell, transfer, or possess unauthorized access devices, a category that covers card account numbers and the codes attached to them. Penalties include fines and prison time, with up to 15 years for offenses that involve trafficking in means of identification.
State laws pile on identity theft and possession charges. Buying is not safer than selling: prosecutors need intent to defraud, and a purchase record plus a chat log supplies it.
How a stolen CVV turns into fraud
The code is what lets someone use a card number online without the plastic. Card-not-present fraud needs no skimmer, no fake card, and no signature, only numbers and a checkout page.
Testing and validation
Fraudsters test stolen records with small purchases at sites that ignore the CVV field, then move to bigger orders once a charge clears. A $1 charge you do not recognize can be exactly that test.
Where the data comes from
Card data leaks from skimmers on fuel pumps and ATMs, merchant breaches, phishing pages, and malware on a shopper's own device. Dark web forums are the resale layer, not the source.
How to protect your card data as a shopper
- Use a virtual card number from your bank for merchants you do not know.
- Turn on transaction alerts for every charge, not just large ones.
- Close the tab on any checkout that never asks for the CVV.
- Keep card details out of browser autofill on shared or work devices.
- Read statements weekly and dispute unknown charges inside 60 days.
How merchants can reduce CVV exposure
PCI DSS forbids storing the CVV after authorization, even in encrypted form. A merchant that keeps the code in a database or a log turns a breach into a card-data breach with legal exposure attached.
- Tokenize card numbers so the account number never sits in your systems
- Require the CVV and address verification on every card-not-present order
- Add 3-D Secure checks for new customers and high-value carts
- Rate-limit checkout attempts to block card testing scripts
- Tell staff never to accept card details over email or chat
What to do if your card data shows up for sale
- Call the issuer and ask for the card to be closed, not just frozen.
- Change passwords on shopping accounts and on the email tied to them.
- Pull your credit reports and look for accounts you did not open.
- File a report at IdentityTheft.gov and keep the report number.
Frequently asked questions
Is it legal to buy a CVV?
No. Buying a card verification value tied to someone else's account is a federal offense, and the transaction record becomes evidence. Curiosity is not a defense once money changes hands.
Can you get your data removed from a carding site?
There is no reliable removal process, and anyone who charges a fee to "delete" your record is running a second scam. Closing the card and monitoring your credit is the practical response.
Does asking for the CVV stop all online fraud?
No. It raises the cost of fraud by forcing a criminal to obtain the printed code as well as the number. Breaches and skimmers can capture both, which is why alerts and virtual card numbers still matter.
Why do carding sites shut down so fast?
Law enforcement treats card marketplaces as a priority target, and operators steal from their own users. Both pressures shorten the life of any site that sells stolen card data.