What a CVV online marketplace is
A CVV online marketplace is a site or chat channel that sells stolen payment card records. Each record is a set of data lifted from a real card: the account number, the expiration date, the cardholder name, the billing address, and the three or four digit verification code. That code is the CVV. Sellers list these records under labels such as "dumps," "fullz," or "CVV."
Buy CVV: Your Ultimate Guide to Safe Online Purchases
No part of that trade is legal in the United States. A site that sells card data is not a gray market. It is a storefront for stolen property, and the people who run it, stock it, and buy from it all face federal charges.
How the trade is organized
The supply comes from card skimmers on fuel pumps and ATMs, phishing pages that copy a bank login, point of sale malware, and breaches at merchants or processors. Data also leaks from employees who photograph cards at a register.
Sellers post batches, and buyers pay in cryptocurrency. Listings advertise a validity rate, which is a claim about the share of cards that still work. That claim has no enforcement behind it. A buyer who sends funds has no recourse if the data fails or if the seller takes the money and disappears. Disputes inside these forums end in bans or threats, not refunds.
The verification code adds a control that a bare card number does not carry. A merchant that requires the code plus address verification can decline a number that arrives without matching data.
US law and penalties
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. It bans producing, selling, transferring, and possessing counterfeit or unauthorized access devices. Payment card numbers and CVV codes count as access devices under the statute.
Related charges stack on top:
- 18 U.S.C. 1028, identity document and identity theft offenses
- 18 U.S.C. 1343, wire fraud
- 18 U.S.C. 1349, conspiracy
- 18 U.S.C. 1030, computer fraud and abuse, when a server or database is broken into
Statutory maximums run to 10 years for most access device counts, plus fines. Some counts carry a 15 year maximum. Courts add restitution and supervised release.
Why card data goes stale
Issuers score transactions as they arrive. A charge from a new device, a new country, or an odd hour raises a flag. Banks send alerts to the cardholder. A card reported lost or stolen stops working at once, and the bank issues a new number. That shortens the shelf life of any record sold on a marketplace. Some listings claim "fresh" data, but freshness measures when the record was taken, not whether the account is still open.
Detection and controls
PCI DSS sets rules for merchants that store, process, or transmit card data. Tokenization replaces the account number with a placeholder that has no value outside one system. Point to point encryption protects data between the terminal and the processor. Address verification and CVV checks catch mismatched data at checkout. Banks add 3D Secure prompts for online orders.
Consumer liability and reporting
The Fair Credit Billing Act caps a cardholder's liability at $50 for unauthorized credit card charges, and at $0 when the card itself was not lost or stolen. Debit cards fall under the Electronic Fund Transfer Act: $50 if the loss is reported within two business days, and up to $500 after that. Card issuer apps let a user lock a card and set alerts for each charge.
Report card fraud to the issuer first, then to the Federal Trade Commission. The FBI Internet Crime Complaint Center takes reports on carding sites and stolen data markets.