Selling CVV online refers to the illegal trade in stolen payment card data, where a card number, expiry date, and verification value are packaged together and offered to buyers who then attempt unauthorized card-not-present purchases. The "process" discussed in underground marketing material is simply a criminal supply chain for moving stolen financial data from one offender to another. It is prosecuted as access device fraud in the United States, and no legitimate payment business participates in it.

selling cvv online process explained

What the term actually covers

CVV stands for card verification value, the three- or four-digit code printed on a card and used to confirm that the person entering a card number physically holds it. In fraud forums the word is often used loosely to describe a bundle of data. Common labels include:

Selling CVV Online Methods: A Comprehensive Guide

  • CVV or CVV2 records: card number, expiry, and verification code, used for online transactions.
  • Dumps: data read from a card's magnetic stripe, historically used to clone physical cards.
  • Fullz: a broader identity package that may include name, address, date of birth, and account details.

Sellers use euphemisms such as "fresh," "good," or "high balance" to signal that a record has not yet been blocked by the issuing bank. Those labels are marketing claims from criminals, not verified facts, and buyers frequently receive data that has already been cancelled.

Selling CVV Online Tutorial: Why It Is Not a Legitimate Guide

The supply chain as described in threat reporting

Public fraud research and law enforcement advisories describe the ecosystem in stages. The summary below exists so defenders can recognize the pattern, not as guidance for participating in it.

Guidance on Selling CVV Online

  1. Acquisition. Card data is obtained through skimming devices, phishing pages, malicious scripts injected into checkout flows, insider theft, or breaches of poorly protected merchants.
  2. Aggregation and testing. Records are bundled into batches and checked with small transactions or card-verification queries to see which numbers still authorize.
  3. Brokerage. Batches are listed on closed marketplaces or sold through messaging channels, often with escrow-style arrangements run by other criminals.
  4. Monetization. Buyers use the data for card-not-present purchases, digital goods, or reshipping schemes that convert stolen credit into resalable merchandise.

Each stage depends on intermediaries who take a cut, which is why card data is repriced constantly and why the advertised quality of a batch means very little.

Why it is illegal in the US

Trafficking in payment card data is covered by 18 U.S.C. § 1029, the federal access device fraud statute, which criminalizes producing, selling, transferring, or possessing unauthorized access devices with intent to defraud. Statutory maximum prison terms under that section run from 10 to 15 years depending on the subsection, before enhancements. Related charges routinely include identity theft under 18 U.S.C. § 1028, wire fraud under 18 U.S.C. § 1343, and conspiracy. Sellers and buyers are both exposed, and marketplace operators face additional charges for running the infrastructure.

Civil consequences follow too. Stolen-card transactions end in chargebacks, and merchants absorb the disputed amount plus fees. Issuers fund recovery teams and pass fraud losses into interchange pricing, which is one reason card data protection is written into the PCI DSS framework.

How issuers and networks detect resold data

Banks do not need to see a marketplace listing to catch this activity. Detection is layered:

  • Verification value checks and address verification (AVS) comparing billing details at authorization.
  • 3-D Secure challenges that push the cardholder through an issuer-hosted step.
  • Tokenization, which replaces the card number with a device-specific token so a stolen number has no reuse value.
  • Velocity and behavioral rules flagging rapid declines, impossible travel, or many cards from one device fingerprint.
  • EMV chips, which stop counterfeit physical cards at the terminal.

Red flags for merchants and cardholders

  • Orders with a billing address that fails AVS but a shipping address that matches, followed by repeated retries.
  • Unusual order volume of easily resold goods, especially with expedited shipping.
  • Multiple card numbers tried from the same session or device.
  • Statements showing small test charges followed by a large purchase.

If your card data is exposed

Freeze the card through your issuer's app, dispute unauthorized charges in writing, and request a replacement number rather than reusing the old one. Identity theft recovery guidance and an affidavit tool are available from the FTC, and a police report helps if accounts were opened in your name. Merchants should preserve order logs and report suspected fraud rings to their acquirer and to the FBI's Internet Crime Complaint Center.

Bottom line

Selling CVV data online is not a business model with a legal version. It is access device fraud built on stolen credentials, investigated by federal agents and card network fraud teams, and prosecuted with prison exposure. The only useful takeaway from the "process" is defensive: tokenization, verification checks, and fast card replacement are what reduce the value of stolen card data to near zero.