CVV selling websites are illegal storefronts that trade in stolen payment-card data. No lawful version of this business exists. The "CVV" in the name refers to the card verification value printed on a credit or debit card, and every listing on these sites rests on data taken from a cardholder without consent. Buying from one, or using data bought from one, is carding, and in the United States it falls under federal access-device fraud statutes carrying prison time.
What these sites trade in
Listings are sorted by data type. Some offer card numbers with CVV and expiry date. Others sell "fullz," which bundle the card number with the holder's name, address, and sometimes a Social Security number. "Dumps" describe magnetic-stripe data. Sellers also publish BIN ranges so buyers can filter by issuing bank or card brand. Every category describes an account that belongs to someone else.
Why "fresh" and "valid" labels mean nothing
Issuers and card networks monitor for compromised numbers and reissue cards in batches when a merchant breach surfaces. A number advertised as fresh can be dead within hours. Carding markets also run on escrow systems that the site operators themselves control, which is why exit scams, where an entire shop closes and keeps every deposit, are common. Security researchers who track these markets find the same stolen records resold across several sites at once.
The legal exposure in the US
- 18 U.S.C. § 1029 covers access-device fraud, including trafficking in unauthorized card numbers, and carries penalties of up to 15 years for trafficking offenses.
- 18 U.S.C. § 1028 covers identity fraud when a stolen identity is used to open accounts or pass verification.
- 18 U.S.C. § 1343 covers wire fraud for the online transactions themselves.
- Conspiracy charges apply to groups working together, and courts routinely order restitution plus forfeiture of equipment and proceeds.
- State identity-theft and computer-crime statutes stack on top of the federal counts.
How these sites get shut down
Domain seizures, undercover purchases, and arrests of marketplace administrators are standard tactics for the FBI and its international partners. Takedowns usually follow years of monitoring, and the seized infrastructure often includes buyer records, which become evidence in later prosecutions.
The Ultimate Guide to Choosing an Online Platform for Selling CVV
Steps to protect your card data
- Open your issuer's app and freeze the card the moment you see an unrecognized charge.
- Request a new card number rather than a replacement card with the same number.
- Place a free credit freeze with Equifax, Experian, and TransUnion.
- Pull your reports at AnnualCreditReport.com and check for accounts you did not open.
- Turn on transaction alerts for every purchase above a threshold you choose.
- Change passwords on shopping accounts and enable two-factor authentication.
Steps to report a CVV selling site
- File a report with the FBI's Internet Crime Complaint Center, which tracks carding complaints.
- Submit a recovery plan at IdentityTheft.gov if your personal data was exposed.
- Call your card issuer's fraud line and ask them to flag the account for card-not-present fraud.
- Report the merchant or domain to the card brand's fraud tip channel so the acquirer can be investigated.