There is no lawful guide to selling CVVs online. A CVV is the security code tied to someone else's payment card, and the inventory traded in "CVV shops" and "fresh dumps" listings is stolen account data. In the United States that trade is a federal crime, not a gray-market hustle, so this page covers the legal reality and the legitimate work that actually pays.
What US law says about card data trafficking
Federal law treats stolen payment card numbers, expiration dates, and CVV codes as "access devices." Trafficking in them, whether you scrape them, buy them, or resell them, falls under fraud and access device statutes with penalties that include prison time and fines. Layering on identity theft, wire fraud, or computer intrusion charges is routine when a case is built. The practical point is simple: every step of the chain, from obtaining the data to advertising it to accepting payment for it, is a separate chargeable act.
Card networks, issuers, and processors also pursue civil claims. A seller can face restitution orders that follow them for years after any criminal case ends, and banking relationships are typically closed permanently.
Why the "CVV vendor" market is a bad bet for the seller
- Buyers are frequently other criminals, undercover investigators, or researchers documenting the ecosystem, so the counterparty carries its own risk.
- Payment rails for these transactions are monitored; processors and banks flag the patterns that carding marketplaces depend on.
- Disputes inside these markets cannot be enforced. Sellers get burned by fake escrow, exit scams, and chargebacks with no recourse.
- Even a small operation creates a durable digital trail: chat logs, crypto ledgers, hosting records, and device fingerprints.
Legitimate work that uses the same skills
People drawn to this space usually have real technical ability: scripting, data handling, network knowledge, or social engineering awareness. Those skills are in demand on the defensive side, where the pay is stable and legal.
- Fraud analytics and risk operations at banks, fintechs, and payment processors, where you build rules and models that catch card testing and account takeover.
- Security engineering and penetration testing, where authorization and written scope make the same techniques legitimate.
- Threat intelligence, where analysts track carding infrastructure and report it to the institutions being targeted.
- Compliance and dispute resolution, where knowledge of how card fraud works translates directly into chargeback and AML roles.
If you have already been involved
Talk to a licensed criminal defense attorney before discussing anything with anyone else, including online contacts. If your own card data has been exposed, report it to your issuer and to the FTC, and place a freeze or fraud alert with the major credit bureaus. If you are an operator whose systems are being probed, document the activity and report it through the appropriate channel rather than engaging the attackers.
The honest answer to "how do I sell CVVs online" is that you don't. The market exists, but it is a criminal market with criminal consequences, and the legitimate version of that career pays better over any realistic horizon.