Short answer
No website sells CVVs lawfully. A CVV or CVC is a 3 or 4 digit code tied to a card account. The code belongs to the cardholder and the issuing bank. It is not inventory.
PCI DSS Requirement 3.2 bars storage of the CVV after an authorization. 18 U.S.C. § 1029 covers trafficking in card credentials and carries penalties up to 15 years per count. Sites that advertise CVV sales are carding forums, which law enforcement tracks, or scam pages that take payment and ship nothing.
Two groups ask this question
Group one wants stolen numbers. Group one has no vendor. Group two runs a store and needs the CVV checked at checkout. Group two has options.
Sell CVV Website Online Cheap: Scam Warning and Card Safety
Pick one: Stripe
Stripe checks the CVV at authorization and passes back the result code (M, N, P, U, S) in the API response. The default Radar rules reject a mismatch on many card types. Setup is a package install and an API key. Fees run 2.9% plus 30 cents on domestic cards. Stripe is PCI DSS Level 1 certified. It never stores the CVV, so a breach of your database does not expose codes.
How to Safely Sell CVV Dumps Websites
Pick Stripe if you want one vendor, published rate cards, and a test mode that returns decline codes on demand.
Other options
- Adyen: enterprise scale, direct acquirer connections, supports local card rules in 40+ markets. Pricing is quote based. Minimum volume thresholds apply.
- Braintree (PayPal): CVV and AVS filters on by default, PayPal wallet in the same integration, 2.59% plus 49 cents.
- Square: flat 2.6% plus 10 cents online, no monthly fee, weakest fit for high-risk verticals.
- Authorize.net: gateway only, needs a separate merchant account, $25 per month plus 10 cents per transaction, full control of filter settings.
Rules that apply to all of them
Store the authorization result, not the code. Tokenize and keep the token. Log declines and review velocity per card and per IP. Set an AVS rule next to the CVV rule, since street address and ZIP checks block different fraud sets.
If you hold a card
Report unauthorized charges to the issuing bank within 60 days. File a complaint with the FTC at reportfraud.ftc.gov and with the FBI Internet Crime Complaint Center. Card networks reissue the number at no cost.