Short answer
There is no legal place to sell CVV or CVC data for Bitcoin. In the United States, selling card data is a federal crime under 18 U.S.C. § 1029, which covers the sale and transfer of unauthorized access devices. The same conduct falls under wire fraud at 18 U.S.C. § 1343 when Bitcoin moves proceeds across state lines or offshore. No payment processor, exchange, or licensed marketplace supports these trades.
What the search results contain
Search engines return three page types for this query: forum threads, how-to blogs, and market listings.
- Forum threads are unmoderated. Account age, post count, and reputation scores are easy to fake.
- Blog pages earn ad revenue. They describe a process and sell nothing.
- Market listings take the seller's data and pay nothing. Escrow accounts on these sites are run by the site owner, not a neutral third party.
A seller has no way to confirm that a buyer exists, that an escrow holds funds, or that a transaction will settle.
Penalties under federal law
A single count under 18 U.S.C. § 1029 carries up to 10 years in prison and a $250,000 fine. Aggravated counts and prior convictions raise the maximum to 20 years. Federal sentencing guidelines add offense levels based on the number of card numbers and the total loss amount. Prison terms above 5 years appear in cases involving 100 or more accounts.
Prosecutors charge sellers, not only buyers. Undercover agents operate accounts on carding forums and buy data to build cases.
How sellers get burned
- Exit scams. The market closes and keeps every balance on deposit.
- Fake escrow. The wallet labeled as escrow is controlled by the buyer.
- Ledger tracing. Bitcoin is a public record. Chain analysis firms sell address cluster data to law enforcement.
- Log exposure. Forum registration captures IP address, email, and payment trails that survive years.
Cardholder controls that reduce exposure
PCI DSS Requirement 3.2 prohibits storage of the CVV2 after authorization. Tokenization replaces the 16-digit primary account number with a surrogate value, so a breached merchant database holds no usable card number. 3-D Secure adds an issuer challenge at checkout. Address verification and velocity checks flag card testing, the pattern that follows a bulk CVV sale.
If your card data is exposed
- Call the issuer and request a new card number and CVC.
- File a report at the FTC identity theft site and keep the confirmation number.
- Review statements for small test charges, which precede larger fraud.
- Place a freeze with the three national credit bureaus if a Social Security number was also exposed.