Short answer

There is no lawful marketplace for CVV data. A CVV is part of a payment card record. Card numbers, expiration dates, and CVVs belong to the account holder and the issuing bank. Selling, buying, or trading them is a federal crime in the United States. Platforms that host such sales get seized. Operators get charged.

What the law says

18 U.S.C. § 1029 governs access devices. The statute defines an access device to include card account numbers, personal identification numbers, and other codes that permit access to an account. A CVV is one of those codes.

Penalties under § 1029:

  • Up to 10 years in prison and fines for a first offense involving one or a few devices.
  • Up to 15 years for offenses involving 15 or more unauthorized access devices.
  • Up to 20 years for aggravated cases, including offenses that yield $1,000 or more in value in a one-year period.

Other statutes stack on top. Wire fraud, 18 U.S.C. § 1343, carries up to 20 years. Aggravated identity theft, 18 U.S.C. § 1028A, adds a mandatory 2-year consecutive term when the offense uses a means of identification of another person.

Where these sales end

Online forums and dark web markets advertise CVV numbers and card dumps. Law enforcement seizes them. The Department of Justice has taken down marketplace infrastructure and charged operators and vendors. Buyers face charges too. Undercover agents run storefronts and ship nothing.

Detection

Issuers run fraud models on card-not-present transactions. Chargebacks trace back to merchant accounts. Card networks and processors flag bulk authorization attempts. A stolen card number has a short useful life.

Reporting

The FBI Internet Crime Complaint Center accepts reports of stolen card data. The FTC accepts identity theft complaints and publishes recovery steps. Both are free.

If your card data was exposed

  • Call the issuer. Request a new card number and a new CVV.
  • Read statements for small test charges.
  • File a report with the IC3 and a complaint with the FTC.
  • Place a fraud alert or credit freeze with the three credit bureaus.