The direct answer
There is no lawful marketplace, forum, or exchange where a person can sell CVV or CVC codes for bitcoin. A CVV is authentication data that belongs to a payment card and its issuing bank, and trading it to a third party is access device fraud under 18 U.S.C. Section 1029, often accompanied by wire fraud, identity theft, and money laundering counts. The sites that appear for this phrase fall into two groups: criminal storefronts that law enforcement seizes on a rolling basis, and scams built to take a seller's bitcoin and disappear. Neither is a real business channel. If the underlying goal is to accept cryptocurrency as a merchant, the compliant path runs through a registered payment processor and a PCI DSS validated checkout, not through card data markets.
What a CVV or CVC actually is
The three or four digit code printed on a card is a shared secret between the cardholder and the issuing bank. It confirms that the person entering the number has the physical card in hand at the moment of the transaction. Because of that role, the PCI Security Standards Council treats the value as sensitive authentication data: it may be used to authorize a payment but must not be stored once authorization completes. A merchant who retains CVV values is out of compliance and carries liability for any breach that follows. That is also why a database of CVV codes is evidence of crime by definition. Legitimate processors tokenize card data so the raw value never sits in a merchant system.
Why this search is a trap
The phrase pairs two things that attract fraud: stolen payment credentials and a payment rail that feels anonymous. Bitcoin is not anonymous. Every transaction is written to a public ledger, and blockchain analysis firms map clusters of addresses to exchanges, services, and people. Federal prosecutors have used that record in fraud cases for years. For anyone considering selling card data, the practical outcomes are narrow:
- Exit scams, where the buyer or escrow service confirms the deposit and then blocks the seller.
- Bait listings that collect card data during a supposed sale and reuse or resell it.
- Malware delivery, where tools offered to check or validate cards install remote access trojans.
- Seizure and sting operations, where a domain is replaced with a notice page after a takedown and logs go to investigators.
- Exchange exposure, since cashing out requires a regulated platform that runs identity checks and files reports.
What happens on the other side
A stolen CVV is not a victimless file. Each one belongs to a household that will spend hours on hold, dispute charges, and replace cards, and to a small business that may absorb chargebacks and higher processing fees. Issuers monitor for patterns, such as a card used once online in a new geography and again minutes later somewhere else. Fraud analytics flag those sequences, and the merchant account tied to the pattern gets reviewed. Buyers in these markets carry the same legal exposure as sellers, plus the near certainty that the data they bought was already used elsewhere.
If your real need is different
Some people search this phrase for reasons that are legal but poorly worded. Merchants who want to accept bitcoin should compare registered processors on settlement time, refund handling, and chargeback policy. Fraud analysts and security researchers who need to study carding behavior should use sandboxed test data from a card network or an academic program, never live credentials. Cardholders who want to know whether their own data is exposed can request a free credit report and turn on issuer alerts.
Protecting your own card data
Most card fraud starts with a leak the cardholder can influence. A short list helps:
- Do not read the CVV aloud in a store or send it over chat or email.
- Enter card details only on a checkout you reached by typing the address yourself.
- Use virtual or single-merchant card numbers for subscriptions and unfamiliar shops.
- Turn on transaction alerts so an odd charge surfaces within minutes.
- Check card readers and ATMs for loose parts or overlays before inserting a card.
- Report a lost card or an unrecognized charge to the issuer the same day.
FAQ
Is it legal to sell CVV codes if I own the card?
No. The cardholder agreement and federal access device law both bar transferring card authentication data to another party for use. Owning the plastic does not create a right to sell its credentials.
Does paying with bitcoin make card data sales legal?
No. The payment method does not change the legality of the goods. Access device fraud is charged the same way whether payment was cash, wire, or crypto, and the ledger record can serve as evidence.
How do I report a site that sells card data?
Report it to the FBI Internet Crime Complaint Center and to the card issuer or network involved. The FTC also accepts reports about payment fraud and publishes recovery steps for consumers.
What is the legal way to accept crypto for my store?
Use a registered payment processor that handles conversion and compliance, and keep card data out of your own systems by relying on a PCI DSS validated checkout.