Is There Any Legal Place to Sell CVV Data?
No. There is no legal market, site, forum, or app where you can sell CVV data on the dark web or on the open internet, because the code belongs to a cardholder and counts as protected financial information. In the US, trafficking in card numbers falls under 18 U.S.C. § 1029 (access device fraud), which carries statutory maximums of 10 to 15 years in prison plus fines and restitution.
Every "CVV shop" you see referenced online is either an illegal operation or a scam aimed at other criminals. Both paths end badly for the person doing the selling.
What Counts as CVV Data?
The CVV is the 3-digit code on the back of most Visa, Mastercard, and Discover cards, or the 4-digit code on the front of American Express cards. It exists to prove the physical card is in hand during a card-not-present transaction.
What gets offered for sale is more than a 3-digit code. Bundles described online as "fullz" hold the card number, expiry date, cardholder name, billing address, ZIP code, and sometimes a Social Security number or account login.
- CVV2 / CVC2 / CID: the printed verification code used by online merchants.
- Track data: magnetic stripe data used to clone a physical card for in-store use.
- Fullz: a full identity bundle that supports new-account fraud, not just card fraud.
The terminology confuses people. CVV1 sits in the magnetic stripe and is read by a terminal, while CVV2 is printed on the card and typed into a checkout page. Sellers mean the printed one.
Why Dark Web Card Markets Keep Appearing
Stolen card data goes stale fast, so criminals built automated shops to move it in volume. These sites sit on Tor or inside closed Telegram channels, take crypto, and sell records in bulk. Entry comes by invitation or a deposit.
Most of these markets fail their own users. Buyers report dead numbers, sellers take payment and vanish, and administrators keep logs of every message. Law enforcement runs undercover accounts inside the same spaces, and the DOJ and Secret Service have seized card shop infrastructure in repeated takedowns.
None of that makes the trade safe. It produces a market where participants cheat each other and where every chat line becomes evidence in a later case.
What Happens to People Who Sell Card Data?
Prosecution is the common outcome. Federal charging documents in card fraud cases rest on chat logs, crypto wallet records, and seized devices, and blockchain tracing is now a standard investigative step.
- Prison: 10 to 15 years is the statutory ceiling for many access device counts, and multiple counts can add time.
- Restitution: courts order repayment to banks and cardholders.
- Forfeiture: crypto, computers, and vehicles bought with proceeds.
- Fallout: loss of banking access, immigration consequences, and a record that blocks many jobs.
How Cardholders Can Protect CVV Data
The strongest habit is to never give the CVV to anyone who calls, texts, or emails you. Banks, utilities, and delivery firms do not need it to confirm who you are.
- Use virtual card numbers from your issuer for subscriptions and one-off purchases.
- Pay with a tokenized wallet so the merchant never receives the real card number.
- Set transaction alerts for any charge above a limit you choose.
- Freeze the card in your banking app the moment something looks off.
- Watch statements for small test charges, which fraudsters run before a large purchase.
How Merchants Reduce Card-Not-Present Fraud
A thief needs a merchant that accepts a number without friction. Layered checks remove that opening.
- Require CVV and address verification (AVS) checks, and decline any order where the two disagree.
- Apply 3-D Secure for high-risk orders and first-time customers.
- Cap order velocity per card, IP address, and device.
- Flag orders where the issuing country, IP location, and shipping address do not line up.
- Store no CVV after authorization. PCI DSS forbids retaining it in any form.
Small stores skip these steps because each one adds checkout friction. Card testing rings find those stores fast and use them to validate thousands of stolen numbers.
What to Do if Your Card Data Is Compromised
- Call the issuer and ask for a new card number, not just new plastic.
- Dispute any charge you do not recognize, in writing.
- Change passwords on shopping accounts and email, and turn on two-factor authentication.
- File a report at IdentityTheft.gov, and at the FBI's IC3 if money was lost.
Replacing the number is the part people skip. A fresh card with the same 16 digits keeps the stolen data valid.
Frequently Asked Questions
Where do criminals sell CVV numbers?
On invite-only forums, private Telegram groups, and automated card shops on Tor. Each one is illegal, and each one is full of scams against its own users.
Is buying CVV data ever legal?
No. Buying card data you have no authorization to use violates 18 U.S.C. § 1029, whether or not a charge is ever made with it.
Do dark web card shops deliver working numbers?
Often not. Buyers report invalid data, dead cards, and sellers who disappear after payment. The market runs on cheating strangers.
Can a merchant legally store my CVV?
No. PCI DSS bans keeping the CVV after a transaction is authorized, and a merchant that asks for it by email or chat is a red flag.
Why do banks still print a CVV if it can be stolen?
It is one layer, not a full defense. The code raises the cost of card-not-present fraud and pairs with address checks, device data, and 3-D Secure to catch stolen numbers.