There is no legal place to sell a CVV, and no legitimate shop that buys one. "CVV shops" are criminal marketplaces that trade stolen card numbers, and buying, selling, or using that data is card fraud under 18 U.S.C. § 1029 in the US. The only place a CVV belongs is a checkout form, typed by the cardholder.
What does "CVV shop" mean?
A CVV shop is a site or chat channel that sells card details in bulk, bundled as card number, expiry date, name, and the three or four digit security code. Sellers call the data "fullz" or "dumps" and price it by card type and country. These sites move addresses, take crypto only, and exist to turn stolen data into cash.
The word "shop" is misleading. There is no warranty, no support line, and no refund when the card turns out to be dead. Operators run the same storefront as a scam against their own buyers.
Are CVV shops legal in the US?
No. Trafficking in access devices is a federal crime, and a card number plus CVV counts as an access device. Penalties reach 10 years in prison for a first offense and 15 years for operations that hit multiple victims.
State laws add charges for identity theft and possession of stolen property. A buyer who never uses the card still commits a crime at the point of purchase.
How does stolen card data reach these shops?
Most CVV data leaves a business through skimmers, phishing, or a breach of the payment page. Web skimming attacks inject script into checkout and copy the form as the customer types. Card data also leaks from unpatched servers, insider theft, and fake support calls.
- Skimming scripts on checkout pages
- Phishing pages that clone a payment form
- Breached merchant databases that kept card data too long
- Card skimmers on fuel pumps and ATMs
PCI DSS forbids storing the CVV after authorization. Merchants that comply remove a whole class of breach risk, which is why card data has to be captured live instead of pulled from a database.
Why buying a CVV is a losing deal
Buyers get burned in predictable ways. Sellers sell the same card to several people, the card gets canceled when the real owner checks their statement, and the site holds the crypto before delivery. Law enforcement watches these marketplaces, so a purchase can become evidence.
Fraud systems work against the buyer too. Issuers flag billing data that does not match, device fingerprints seen across many cards, and shipping addresses tied to prior chargebacks.
How do you protect your own CVV?
At checkout
Type the code by hand. Skip autofill for the CVV unless you use the site often and trust it. Check that the address bar shows the merchant's real domain and a padlock before you enter the digits.
Keep the code off paper and out of chat
Never send a photo of your card or read the CVV over the phone to someone who called you. Banks do not ask for it on an inbound call. Store the physical card in a wallet, not in a desk drawer.
Use virtual cards
Many US issuers offer virtual card numbers for online use. A virtual number carries its own CVV, so a breach at one store does not expose your main card.
Watch for skimmers
On a website, a skimmer is injected script. Keep the browser updated, block scripts the page does not need, and avoid saving cards on small stores. On a fuel pump or ATM, tug the card reader and look for loose panels before you swipe.
What should you do if your card data leaks?
- Freeze the card in your banking app or call the number on the back.
- Report the fraud to the issuer and dispute charges you did not make.
- Change passwords on shopping accounts that stored the card.
- File a report with the FBI's Internet Crime Complaint Center and a recovery plan with the FTC if identity theft is involved.
Federal rules limit what you can lose on unauthorized credit card charges, and most US issuers waive the rest. Speed still matters, because fast reporting shuts the account down before the data gets resold.
FAQ
Where can I sell a CVV?
Nowhere. No bank, processor, or marketplace buys CVV codes from individuals. An offer to "sell your card details for cash" is either a data-harvesting scam or an attempt to make you a money mule.
Is selling your own card data ever legal?
No. Even with your consent, handing card data to a third party for use breaks your cardholder agreement and often the law. The person who buys it uses it for fraud, and you end up in the investigation.
How do I know if my CVV was used?
Look for small test charges, new subscriptions, and shipping notices for orders you did not place. Card testing often starts with a $1 charge. Report any charge you cannot explain.
Do merchants need my CVV to process a refund?
No. A refund goes back to the same card number. A caller who asks for the CVV to "verify" a refund is running a scam.