There is no legitimate place to sell a CVV. The CVV is the three- or four-digit code printed on a payment card, and its only job is to prove that whoever is typing the card number is holding the physical card. Selling it, buying it, or brokering it is trafficking in unauthorized access devices under 18 U.S.C. § 1029, a federal charge that carries a statutory maximum of 10 years for a first offense and 15 for a later one. Every site, chat group, or forum that advertises itself as a place to sell CVVs is either a criminal marketplace or a scam built to take money from the seller. The practical answer is short: keep the code private, and if you find card data that is not yours, report it instead of trying to monetize it.
What a CVV actually is
The code appears on the back of most Visa, Mastercard, and Discover cards and on the front of American Express cards. It is generated by the issuer and tied to the account, but it is not stored in the magnetic stripe or the chip. That design is deliberate: a card number alone can be reused indefinitely, while a number plus a valid CVV is much harder to assemble from a single data leak.
- It is not a password, and it is not secret from the cardholder.
- It cannot be reset or changed without replacing the card.
- Merchants are not permitted to store it after an authorization, under PCI DSS Requirement 3.
Why the search exists, and what it actually returns
Most searches for a place to sell card data come from one of three situations: someone found a skimmer or a stash of numbers and wants cash, someone was pitched a "reselling" scheme, or someone is curious about how the underground economy works. All three roads lead to the same place. Automated marketplaces and invite-only chat channels do exist, and they are run by criminal groups. They are also hostile to newcomers. Common outcomes for a seller include escrow accounts that freeze, buyers who dispute and reverse payments, and operators who collect identity documents during "verification" and then use them for identity theft.
There is no consumer protection, no dispute process, and no recourse. A person who is cheated in a card-data deal cannot report the loss without describing their own crime.
Legal exposure for anyone who sells, buys, or holds card data
Federal law does not require a completed purchase to trigger liability. Offering card data for sale, possessing it with intent to defraud, and producing or trafficking counterfeit access devices all fall inside the same statute. Courts have treated bulk files of account numbers as evidence of intent on their own.
- Federal charges under 18 U.S.C. § 1029, with forfeiture of proceeds and equipment.
- State charges for identity theft and unlawful possession of personal identifying information, which stack on top of the federal counts.
- Restitution to issuers and merchants for chargebacks, reissue costs, and fraud losses, often far beyond what the data sold for.
- Civil exposure from card networks and banks that pursue recovery separately.
Why merchants treat the CVV field as a control, not a convenience
For an online store, the CVV is one of the few signals that separates a real cardholder from someone reading a leaked number off a list. That is why checkout forms ask for it and why declining a mismatched code is standard practice. It is also why storing the code is prohibited. A merchant who keeps CVVs in a database turns a routine breach into a much larger liability, because the storage itself violates card network rules.
Steps to keep your own card data off resale lists
- Type card numbers only on sites with a full HTTPS connection and a recognizable payment processor.
- Decline to send card details by email, text, or social message, even to a seller who seems established.
- Use tokenized checkout or a virtual card number for subscriptions and unfamiliar merchants.
- Cover the code when filming, streaming, or photographing a card, including in support chats.
- Review statements monthly and act on small unrecognized charges, which are often tests before a larger one.
If you find card data or a marketplace, report it
Report suspected card fraud and identity theft to the FTC, which routes complaints to law enforcement partners. Report cyber-enabled financial crime through the FBI's Internet Crime Complaint Center, including screenshots and account details. Tell the issuing bank as well, since it can block the accounts before losses spread. Researchers and security teams who discover a card-data operation should preserve evidence and contact the affected issuer or the card network's fraud team rather than engaging with the operators.
Bottom line
Anyone asking where to sell a CVV is asking where to commit a felony with extra steps. The code has one legitimate use, which is confirming a purchase you are making with your own card. Treat it like cash, and treat every offer to buy or sell it as a crime in progress.