Selling CVV data is a federal offense in the United States
A CVV is the three or four digit code printed on a payment card. Card networks use the code to confirm the card is in hand. A person who does not hold the card cannot derive the code from the account number. Selling CVV data means selling access to accounts that belong to other people.
18 U.S.C. § 1029 is the main statute. Subsection (a)(2) covers a person who traffics in unauthorized access devices within a one year period and obtains $1,000 or more in value. Subsection (a)(3) covers possession of 15 or more unauthorized access devices. A card number with its CVV is an access device under the definition in § 1029(e)(1).
Penalties
- Up to 10 years in prison and a fine for convictions under § 1029(a)(2) and § 1029(a)(3).
- Up to 15 years for other § 1029 offenses, such as producing or selling device making equipment.
- Two years of prison, consecutive to any other sentence, under 18 U.S.C. § 1028A when the offense involves another person's means of identification.
- Restitution to cardholders, issuing banks, and merchants under the Mandatory Victims Restitution Act, 18 U.S.C. § 3663A.
The United States Sentencing Commission sets the prison range. Guidelines § 2B1.1 uses the total loss figure to set the offense level, then adds adjustments for the number of victims and for use of a computer.
Who investigates
The Secret Service has authority to investigate § 1029 offenses. The FBI and the Postal Inspection Service also open cases. Prosecutions come from U.S. Attorney's offices. State attorneys general can bring separate charges under state card fraud and larceny statutes.
Sell CVV Online v2: What the Term Means and Why It Is Illegal
Reporting
Cardholders dispute charges with the issuing bank. Complaints go to the FTC and to the FBI Internet Crime Complaint Center. Reports from cardholders and banks supply the transaction records that cases rely on.
Scope of this page
This page states the law and the penalties. It does not list sellers, marketplaces, prices, or payment methods, and it does not describe how card data is obtained.