Short answer
No. There is no legal website that sells CVV numbers. A CVV is part of a payment card's authentication data. It belongs to the cardholder and the issuing bank. Selling it to a third party is a federal crime in the United States. Sites that advertise CVV sales fall into two groups: fraud marketplaces and scams that collect payment and deliver nothing.
What a CVV is
CVV stands for card verification value. Visa, Mastercard, and Discover print a 3-digit code on the back of the card. American Express prints a 4-digit code on the front. The code proves the person entering the card number holds the physical card. PCI DSS v4.0 requirement 3.2.1 forbids storing this data after authorization. A merchant that keeps CVV data is out of compliance.
Why no legitimate seller exists
Card networks issue CVVs to banks, not to resellers. Banks do not license CVV data for sale. There is no wholesale channel, no distributor, and no reseller agreement. A company cannot obtain CVV numbers through legal means and then sell them. Every listing offers data taken from a cardholder without consent.
What the sites do
FBI IC3 reports on carding operations describe two common outcomes. Some sites are fronts that collect cryptocurrency and close. Others sell data that fails at checkout because the bank blocked the card. Buyers have no recourse. A payment dispute would require admitting intent to commit fraud.
US law and penalties
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Trafficking in a card number paired with a CVV carries up to 10 years in prison for a first offense and up to 15 years in aggravated cases. Counts add up per device. A seller holding 500 card records can face 500 counts.
Legal services with similar names
- Card verification: processors check the CVV at checkout for the merchant. The merchant never stores the code.
- Tokenization: the network replaces the card number with a token. The CVV is not part of the token.
- Identity verification: vendors check government IDs and databases. This is not card data.
How to judge a payment site
Look for a PCI DSS attestation of compliance. Look for a company registration. Check if the site asks for full card data or redirects to a bank-hosted page. A site that offers to sell you card numbers fails all three tests.