"CVV sale in bitcoin" describes listings that offer card verification values, or full card records, in exchange for bitcoin. The trade is illegal in the United States. 18 U.S.C. § 1029 covers trafficking in stolen payment card credentials. A first offense carries up to 15 years in prison and a $250,000 fine for an individual.
What a CVV is
A CVV is the three or four digit code printed on a payment card. It sits apart from the card number and the expiration date. Merchants use it to confirm that the person placing an order holds the physical card. A card number alone can be guessed or generated. A CVV cannot be derived from the number.
CVV Exchange for Digital Coins: A Comprehensive Guide
That design is the reason the code appears in fraud listings. A seller who supplies the number, the expiration date, and the CVV supplies a set that passes a card-not-present check.
How the listings appear
Offers show up on darknet markets, on closed messaging channels, and on sites built to mimic ordinary retail pages. Common formats include:
- Single records with a card number, expiration date, CVV, and cardholder name.
- Bulk files sorted by country, card brand, or bank.
- "Dumps," which are magnetic stripe data copied from a card.
- Fullz, which bundle card data with a Social Security number, address, and date of birth.
Prices vary by card type, issuing bank, and country. Listing sites quote ranges. No independent registry verifies those numbers, and the figures come from the sellers.
Why bitcoin appears in these offers
Bitcoin moves between wallets without a bank in the middle. A seller can receive payment across borders in minutes. The blockchain is public, so every transfer is recorded. Chainalysis reported that illicit addresses received $24.2 billion in 2023.
Federal law treats the proceeds of card fraud as covered by anti-money laundering rules. FinCEN requires money services businesses to file reports on suspicious transfers.
Legal status and penalties
Buying card data is a crime, not a purchase. The relevant statutes include 18 U.S.C. § 1029 for access device fraud and 18 U.S.C. § 1028 for identity documents. Sentences rise with the number of cards, the dollar loss, and any prior record. Federal prosecutors have charged buyers, sellers, and forum operators in the same cases.
What happens to buyers
Buyers send bitcoin and receive data that may be expired, already used, or fabricated. Sellers have no refund process and no court to appeal to. Payment records on the blockchain stay visible, and investigators use them to trace transfers.
Card protections that block this data
- Tokenization replaces the card number with a one-time code for online merchants.
- 3-D Secure sends a push notice to the cardholder's phone for each online charge.
- Card controls let a holder freeze a card, set spend caps, or block foreign charges.
- Address verification checks the billing ZIP code against the issuer record.
Reporting
Cardholders report unauthorized charges to the issuer. The FTC recorded $10 billion in total fraud losses for 2023 through its Consumer Sentinel Network. The FBI accepts complaints through its Internet Crime Complaint Center.