Short answer
A website that sells CVVs is an illegal storefront for stolen payment card data. Buying, selling, or brokering that data is a federal crime in the United States, and most of these sites are built to steal from the people who use them. There is no lawful version of this business. If your goal is to accept card payments, the route is a merchant account or a payment processor, not a CVV shop.
What the term means
CVV stands for card verification value. It is the short code printed on a payment card and used as one check that the person typing the card number is holding the physical card. Card issuers generate it. The PCI Security Standards Council forbids merchants from storing it after a transaction is authorized, which is the main reason stolen CVV data has value on criminal markets. It is the one piece of the card that a fraudster cannot pull from a typical database breach.
Where the number sits on each card
- Visa, Mastercard, Discover: three digits on the back, near the signature strip.
- American Express: four digits printed on the front, above the card number.
- Some issuers call it a CVC or CID. Same idea, same rules.
Why these websites are traps
Court filings and consumer complaints show a pattern. A shop appears, takes crypto, and vanishes. Others keep the money and deliver nothing, or hand over numbers that were cancelled months earlier. A seller with no reputation to protect has no reason to honor a deal. There is also the honeypot problem: some sites exist to collect buyer data, IP logs, and wallet addresses for a later investigation.
The legal exposure is not small
18 U.S.C. ยง 1029 covers fraud and related activity in connection with access devices, and selling card numbers and CVVs falls under it. Federal sentencing treats each card as its own count, so a few hundred records can turn into a decade or more in prison. Prosecutors stack wire fraud, aggravated identity theft, and money laundering charges on top. The FBI and Secret Service have run repeated takedowns of carding forums, and they keep the seized records.
What happens on the other end
A stolen card number that gets used triggers a chargeback. The cardholder files a dispute, the issuer reverses the charge, and the merchant eats the loss plus fees. That is why banks watch for it and why card networks keep pushing tokenization, EMV chips, and 3-D Secure. Each of those changes makes raw CVV data less useful over time. The market is shrinking for the same reason it was never safe to enter.
If you want to sell online for real
Accepting cards as a legitimate business requires a merchant account through a bank or a processor such as Stripe, Adyen, or Square. You agree to PCI DSS rules, you never store CVV data, and you pay interchange fees. Setup is slower and it comes with underwriting. It also means you keep the money you earn, you can advertise in the open, and nobody is going to knock on your door with a warrant.
Bottom line
Searching for a website that sells CVVs leads to criminal marketplaces, exit scams, and federal charges. The technical term has a legitimate definition. The commercial use of it does not. Card data belongs with issuers and processors under PCI rules, and anyone selling it online is either breaking the law or breaking a promise to you.