Short answer
There is no legal place to sell CVV dumps in the United States. A CVV dump is card data copied from a payment card without the cardholder's consent. Banks, card networks, and payment processors do not buy it. Forums, chat channels, and dark web storefronts that trade it are criminal markets. A sale there is the crime, not a workaround.
What a CVV dump contains
The term covers a bundle of card data. Common fields:
- Primary account number (the 15 or 16 digit card number)
- Expiration date
- CVV or CVC verification code (3 digits on Visa, Mastercard, Discover; 4 on American Express)
- Cardholder name and billing ZIP
- Magnetic stripe track data, in some listings
A dump with a valid CVV lets a buyer attempt a card-not-present purchase. That is why merchants ask for the code.
Legal status
Federal law covers this directly. 18 U.S.C. 1029, fraud and related activity in connection with access devices, makes it a crime to traffic in counterfeit or unauthorized access devices. A payment card and its account number qualify as access devices. Penalties reach 10 years in prison for a first offense and 15 years for a later one. A fine follows the prison term.
Related charges stack on top:
- 18 U.S.C. 1343, wire fraud, for transactions that cross state lines or use the internet
- 18 U.S.C. 1028A, aggravated identity theft, adds 2 years mandatory and consecutive when the seller uses another person's identity
- State laws on larceny, forgery, and computer crime
How card data gets taken
Dumps come from three main sources:
- Skimming hardware on fuel pumps, ATMs, and card readers
- Merchant data breaches, where a point-of-sale system or database is copied
- Phishing pages and malware that capture checkout form entries
Attackers then pool the records and list them in bulk. Prices track card type, balance, and country of issue.
Enforcement
The FBI, the U.S. Secret Service, and the Department of Justice investigate and prosecute card fraud rings. Tactics include undercover buyers, server seizures, and blockchain analysis of cryptocurrency payments. Convictions follow arrests in most federal cases that reach trial.
If your card data is exposed
- Call the issuer and ask for a new card number. The old number stays dead.
- Review statements for charges you did not make.
- Dispute each unauthorized charge in writing.
- Report the incident at IdentityTheft.gov.
- File a police report if the loss is large or an identity was used.
- Place a credit freeze with all three bureaus if a Social Security number was also exposed.
Reduce the risk on your own cards
- Use virtual card numbers for online merchants when the issuer offers them.
- Keep the CVV off saved notes, screenshots, and shared photo libraries.
- Turn on one-time passcodes or 3-D Secure for every card that supports it.
- Skip saved-card storage on shared or public devices.
- Check statements each month, not each quarter.
Report a listing or a loss
Send complaints to the FBI Internet Crime Complaint Center and to the FTC. Include dates, amounts, merchant names, and any chat handles. The FTC does not resolve individual cases, but the data feeds federal and state investigations.