Short answer
There is no legitimate or safe place to sell CVVs. A CVV is the 3 or 4 digit card verification value printed on a payment card. It exists to prove the person holding the card number also holds the physical card. Selling or buying it without the cardholder's authorization is card fraud, not a market activity.
How to Legitimately Sell CVV Online: A Complete Guide
Every site that advertises CVV sales is either a criminal marketplace, a scam that takes the seller's money, or a law enforcement operation. None of the three protects the seller.
What US law says
- 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Selling, transferring, or possessing card numbers and CVVs with intent to defraud is a felony. Statutory maximums run to 10 years for a first offense and 15 to 20 years for repeat or aggravated conduct, plus fines.
- 18 U.S.C. § 1343 (wire fraud) applies when card data moves over the internet, which it always does.
- 18 U.S.C. § 1028 covers identity documents used to open accounts in another person's name.
Prosecutions are brought by US Attorney's offices and the Department of Justice Computer Crime and Intellectual Property Section. Federal sentencing guidelines add levels for the number of victims and the dollar loss.
Licensed CVV Selling Websites: No License Exists
Why the channels are not safe
Card networks and issuers run continuous monitoring. A card reported as compromised is reissued, and the old number stops working. That means inventory sold today can be dead tomorrow, and buyers know it.
How to Safely Sell CVV Online Without Getting Scammed
Criminal forums that host this trade are infiltrated. Buyers on those forums use escrow scams, chargeback-style disputes, and doxxing against sellers. There is no arbitration, no contract enforcement, and no recourse if the other side takes the money and leaves. Sellers have been identified from payment trails, chat logs, and seized servers.
What card data can legally be handled
Businesses handle card numbers only as authorized merchants or service providers. The relevant rules come from the payment card industry data security standard, contracts with acquirers, and federal law. Legal activities include:
- Accepting card payments as a registered merchant through an acquiring bank.
- Processing payments as a PCI-compliant service provider under a written contract with the merchant.
- Selling card data back to an issuer in a documented, authorized fraud-recovery program.
- Penetration testing or research with written authorization from the card issuer or processor.
None of these involve a public marketplace, and none involve resale of a consumer's CVV.
Consequences on record
DOJ press releases list carding cases each year. Typical outcomes include prison terms measured in years, restitution orders, forfeiture of computers and funds, and supervised release with computer restrictions. A conviction also closes access to banking, payment processing, and most employment that requires a background check.
If you have been a victim or a witness
Report card data theft to the FTC at IdentityTheft.gov and to the FBI Internet Crime Complaint Center. Issuers handle reissuance at no cost to the cardholder.