There is no legal place to sell CVV or CVC data for bitcoin. Selling card verification values is access device fraud in the United States, and taking bitcoin as payment adds a money laundering charge on top. Every site that advertises this trade runs outside the law, and both sides of the deal carry real prison risk.
The payment method changes nothing about that. Bitcoin leaves a public record of every transfer, which makes a card-data sale easier to trace, not harder. This guide covers how the so-called CVV market works, why it burns most people who touch it, and how to keep your own card numbers out of it.
How do “CVV shops” that take bitcoin operate?
Card-data shops are illegal storefronts on the open web or Tor where sellers list stolen card numbers, expiration dates, and CVVs. Buyers pay in bitcoin or another crypto, then test the numbers against small online purchases. The system rests on stolen data, and none of it carries legal protection.
Three things happen to people who use these sites:
- Fake escrow. The shop holds the seller's data or the buyer's coins and keeps both. There is no regulator, no chargeback, and no court to complain to.
- Ripper scams. “Ripper” is forum slang for a member who takes payment and disappears. Forums ban them after the fact, which returns nothing.
- Law enforcement stings. Agencies run fake shops and fake forum accounts to collect identities. One login can tie a real person to a federal case.
Prices quoted on those sites run low, often a few dollars per card, and that is part of the lure. The cost of a conviction runs into the tens of thousands in legal fees, restitution, and lost income.
What is a CVV or CVC number?
A CVV (card verification value) or CVC (card verification code) is the short security code printed on a payment card. Visa and Mastercard place three digits on the back; American Express places four on the front. The code exists to prove that the person typing the number holds the physical card.
Online merchants ask for it on every card-not-present purchase. That makes it the most valuable field in a stolen card record, because a card number alone fails most checkout checks.
Do merchants store CVV codes after a purchase?
No, and they are not allowed to. PCI DSS bans keeping sensitive authentication data, including the CVV2, once a transaction is authorized. A merchant that stores CVVs fails its compliance audit.
Stolen CVVs come from other places: skimmers on gas pumps and ATMs, phishing pages that copy checkout forms, malware on a home computer, and breaches at payment processors. A card is safe until someone photographs it or types the code into a page they do not control.
Is selling CVV data with bitcoin a federal crime in the US?
Yes. Federal law treats card numbers, CVVs, and account credentials as “access devices,” and 18 U.S.C. § 1029 covers producing, selling, and possessing them with intent to defraud. Prosecutors pair that charge with wire fraud and identity theft counts when crypto moves the money.
Bitcoin does not act as a shield. Exchanges require identity verification, blockchain analysis firms map wallet clusters, and a subpoena reaches the exchange's records. Cases built this way end in restitution orders that follow a defendant for years.
How do you keep your own card data out of these markets?
- Use a virtual card number for subscriptions and one-off purchases. Most major US issuers offer them inside the banking app.
- Type the merchant address yourself instead of tapping links in email or texts.
- Turn on transaction alerts for every charge above a small threshold.
- Check the checkout page for HTTPS and a recognizable payment processor before you enter the code.
- Skip saving the card at checkout unless the site is one you use often.
What should you do if your CVV was exposed?
- Call the issuer and ask for a replacement card with a new number and a new CVV.
- Freeze the card in the banking app until the new one arrives.
- Review statements for small test charges, which often come before a large one.
- Change the password on any shopping account where the card was stored.
- File a report with the FTC and, if money was lost, with the FBI's IC3.
Frequently asked questions
Is buying or selling CVV data ever legal?
No, apart from narrow authorized testing by card networks, issuers, and security firms under contract. A private sale between strangers has no legal route in the US or the EU.
Can bitcoin payments be traced?
Yes. The blockchain records every transfer and keeps that record public. Analysts link wallets to exchanges and to known fraud clusters, and exchanges hand over identity records when served with legal process.
How can I tell if my card is being sold online?
You usually cannot see the listing. The practical signal is a small unfamiliar charge, a declined transaction, or a fraud alert from your issuer. Report any of those right away.
Does a VPN or a burner email hide a CVV sale?
No. Investigators work from the money side, the exchange records, and the device, not from the shop login. Anonymity tools fail at the point where crypto converts back to spendable currency.
What happens to the buyer in a carding case?
Buyers face the same access device statutes as sellers, plus identity theft counts for each card used. Restitution to the issuer and the merchant is common, and a fraud conviction can block banking and job options afterward.