Short answer
Selling CVV data is a federal crime in the United States. Stolen card numbers do trade on hidden forums, so the market exists. The offers most people see through search ads, chat apps, and bots are a second layer of fraud aimed at the buyer. Both facts are true at the same time.
What a CVV is
A CVV is the 3 digit code on the back of a Visa, Mastercard, or Discover card, or the 4 digit code on the front of an American Express card. Card networks require it for transactions where the card is not present. A card number without the CVV, the expiry date, and the cardholder name fails most checkout checks.
Is the seller real or a scam
The seller is the wrong question. Nobody who sells stolen card data can deliver a legal product. A buyer has no recourse when a seller takes payment and stops replying. Fraud researchers describe the same pattern in case after case: payment first, delivery never, or delivery of records that were sold to other people and shut down by the issuer.
How to Avoid Scams When Selling CVV Online
Common patterns in these offers
- Upfront crypto payment with no escrow and no sample.
- The same card record sold to several buyers.
- Bots that stop replying after the first payment.
- Free checker tools that capture the card data typed into them.
- Accounts, ratings, and reviews written by the seller.
Legal exposure
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Penalties include fines and prison terms that reach 10 years, with longer terms for repeat or high-value offenses. Buying stolen card data carries charges under the same statute as selling it. Aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory 2 year term that runs after the underlying sentence. State prosecutors file separate charges.
Why the data degrades
Chip cards, tokenization, and 3-D Secure authentication limit what a card number can do. Issuers block card-not-present charges that do not match a cardholder's normal pattern. Breach data ages. A list bought today holds numbers from breaches that banks have already flagged.
If your card data leaked
- Call the issuer and ask for a new card number.
- Read statements line by line and dispute unauthorized charges. The Fair Credit Billing Act gives 60 days from the statement date to notify the creditor in writing.
- Report the fraud to the FBI Internet Crime Complaint Center and to the FTC.
- Pull your free credit reports from the three nationwide bureaus and freeze your files.
Scope of this guide
This page does not list markets, vendors, prices, or tools. It does not explain how to buy or sell card data. It covers what the question asks: the law and the risk.