There is no legal place to sell CVVs. A CVV is the security code printed on a payment card, and selling it (or any card data tied to someone else's account) is a federal crime in the US. Every shop, forum, and vendor that advertises CVV sales is a scam, a criminal marketplace, or a law-enforcement operation. None of them are legal.
Where to Sell CVV Safely: A Guide to Secure Online Transactions
What a CVV is
The CVV (card verification value) is the 3-digit code on the back of a Visa, Mastercard, or Discover card, and the 4-digit code on the front of an American Express card. Networks also label it CVV2, CVC2, or CID. It exists for one job: to prove the person entering the card number has the physical card in hand.
That job depends on the code staying secret. Once a CVV is written down, stored, or passed to a third party, it stops being a security feature and becomes a stolen credential.
Why selling CVVs is illegal in the US
Federal law treats card numbers, PINs, and CVVs as "unauthorized access devices" when they belong to someone else. Under 18 U.S.C. § 1029, producing, selling, transferring, or possessing them with intent to defraud is access device fraud, a felony that carries years in federal prison and heavy fines.
Charges stack. A single CVV sale can also bring wire fraud, identity theft, and money laundering counts. Aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory two-year sentence that runs on top of the underlying term.
- Selling card data across state lines brings federal jurisdiction.
- Crypto payments leave a trail. Exchanges keep records and answer subpoenas.
- Card networks and issuers fund investigation teams that work with the FBI and Secret Service.
Does an offshore site make CVV sales legal?
No. Where a site is hosted does not change the law for the person selling or buying. US courts have jurisdiction over US residents who commit access device fraud from a laptop on US soil, and extradition treaties cover many countries.
"Gray area" and "licensed vendor" claims are sales copy. No country runs a regulated CVV exchange, because the underlying data is stolen by definition.
Why CVV shops never work the way they claim
- "Fresh data" is marketing. Buyers get reused, dead, or invented numbers.
- Most shops close after a few weeks and take account balances with them.
- Some are run by investigators to identify buyers.
- Reviews and vouches come from the same people selling the data.
The one reliable pattern in that market: the seller gets paid and the buyer takes the legal risk.
What a conviction costs
Sentencing depends on the loss amount, the number of cards, and prior record. Judges count victims, and restitution orders can follow you for years after release.
- Forfeiture of computers, phones, and crypto wallets.
- Court-ordered restitution to issuers and cardholders.
- A felony record that closes off most finance and tech jobs.
Legitimate work that handles card security codes
Plenty of legal jobs touch CVV data. They all share one trait: the code is checked and then discarded, never stored or resold.
Payment processing and tokenization
PCI DSS rules bar merchants and processors from storing the CVV after a transaction is authorized. Tokenization vendors swap card numbers for tokens so the real data never touches a merchant's systems. Companies in this space sell software and services, not card records.
Fraud and risk analysis
Banks, issuers, and payment firms hire analysts to spot stolen-card patterns. The work runs on aggregated, de-identified data inside a controlled environment.
Authorized security testing
Card networks and issuers run bug bounty and pen-test programs. Researchers get paid a fee for reporting flaws, and the scope sits in a written agreement. Selling the card data you find is not part of any of those programs.
Test card numbers for developers
Payment processors publish fake card numbers with matching CVVs so developers can test checkouts. Those numbers work only in sandbox mode and carry no real account.
Someone offered to buy your card details?
There is no legitimate buyer for a personal CVV. A real business never asks for your security code by email, text, or phone, and no bank needs it to "verify" you.
Anyone offering cash for your card details is setting up fraud in your name or using your account as a mule. Block them and call your issuer.
How to report CVV theft or a CVV shop
- Call the number on the back of your card and ask for the fraud team. Request a new card number.
- File a report at IdentityTheft.gov, the FTC's recovery tool.
- Report internet crime to the FBI's IC3 unit.
- Give local police the case number if money was taken.
Common questions
Is it legal to sell my own CVV?
No legitimate marketplace exists for it, and cardholder agreements forbid sharing the code. Selling your own card data still feeds fraud, and you can be held liable for charges that follow.
Are "dumps" or "fullz" sites legal?
No. Dumps are magnetic-stripe data copied from cards, and fullz are bundles of personal and financial records. Both are stolen property, and buying or selling them is a federal offense.
Is buying a CVV legal?
No. Buying card data to make a purchase you are not authorized to make is access device fraud, even when the seller takes your money and vanishes.
What is the legal way to earn money from card security skills?
Work for a processor, issuer, or fraud-prevention vendor. Join published bug bounty programs. Build tools that help merchants meet PCI DSS. Those roles pay for skill, not for stolen numbers.