There is no legal CVV shop and no legitimate marketplace where you can sell or buy CVV data. Card verification values, full card numbers, and cardholder names belong to real people, and trading them is access device fraud under U.S. federal law. This guide explains what these sites are, what happens to the people who run and use them, and where to go if your own card data appears for sale.

This page is not a directory of shops and does not link to any. It covers the legal reality, the penalties, and the defenses that work.

What is a CVV shop?

A CVV shop is a website, forum, or chat channel that sells stolen payment card records. A single listing may include the card number, expiration date, CVV, cardholder name, billing address, and issuing bank. The storefront copies the look of normal retail software, but the inventory is stolen data.

Sellers get that data from card skimmers, phishing pages, malware on checkout sites, and breaches at merchants and processors. The price of a record depends on the card type, the country of issue, and whether the card has been tested with a small charge.

Is it illegal to sell CVV data?

Yes. Every part of the chain is a federal offense in the United States: stealing the data, selling it, buying it, and using it to move money. The main statute is 18 U.S.C. § 1029, which covers fraud and related activity in connection with access devices.

  • 18 U.S.C. § 1029 (access device fraud): covers producing, trafficking in, or using unauthorized card numbers. Statutory maximums run 10 to 15 years per count.
  • 18 U.S.C. § 1028A (aggravated identity theft): adds a mandatory two-year prison term, served after the sentence for the underlying crime.
  • 18 U.S.C. § 1343 (wire fraud): covers the online sale itself, with up to 20 years per count.
  • 18 U.S.C. § 371 (conspiracy): applies to anyone who coordinates the operation, including people who only run the payment page or host the site.

Felony convictions also carry fines up to $250,000 for an individual under 18 U.S.C. § 3571, plus restitution to banks and cardholders. One operation can generate several counts.

Does the government go after sellers or buyers?

Both, but operators draw the most attention. Federal cases have targeted the people who build card shops, run the crypto payment rails, and handle customer support. Buyers who use the data to order goods or cash out face wire fraud and identity theft charges once the losses add up.

What about hosts, affiliates, and advertisers?

A person who hosts, advertises, or processes payments for a CVV shop can be charged as a co-conspirator without ever touching a card number. The same logic applies to affiliates and review pages that send traffic to these sites for a cut of the sale.

Do CVV shops sell real card data?

Some do and some do not. Many listings are recycled numbers from old breaches that get declined at checkout, and a large share of these sites are outright scams that take crypto and deliver nothing. The shop model also attracts law enforcement operations and competitors who drain buyer deposits.

Card networks watch for the small test charges that sellers use to grade cards. Those tests trigger velocity rules and account flags, which makes freshly stolen data go stale fast.

Why stolen card data is worth less than it used to be

  • Tokenization: networks swap card numbers for tokens at checkout, so a breach of a merchant system exposes tokens instead of usable card numbers.
  • EMV chips: copied magnetic-stripe data fails at chip-enabled terminals.
  • Behavior scoring: issuers block charges that break a cardholder's normal pattern, often before an order ships.
  • Zero-liability rules: cardholders get refunded, so the loss lands on banks and merchants, which fund large fraud teams of their own.

How to check if your card data was exposed

  1. Read your statements line by line, including small charges that look like subscriptions.
  2. Pull your credit reports from AnnualCreditReport.com and look for accounts you never opened.
  3. Set transaction alerts in your banking app for any charge above an amount you choose.
  4. File a report at IdentityTheft.gov if you find signs of identity theft. That gives you a recovery plan and a paper trail.

How to protect your cards and accounts

  • Use virtual card numbers for subscriptions and one-off purchases.
  • Turn on two-factor authentication for bank, email, and shopping accounts.
  • Freeze your credit with all three bureaus when you are not applying for loans.
  • Keep card numbers out of browsers, notes apps, and screenshots.
  • Pay through a recognized processor rather than a direct bank transfer.

If you want to sell online, open a merchant account

People search for CVV shops for two reasons: to cash out stolen cards, or to accept card payments without underwriting. The second problem has a lawful answer. A registered merchant account with a PCI-compliant processor lets you accept major cards, and platforms such as Stripe, PayPal, and Square handle the card data so it never touches your servers.

Affiliate programs, reseller agreements, digital downloads, and service businesses all run on normal payment rails. The paperwork is boring. It also keeps you out of federal court.

How to report card fraud

Call your bank or card issuer first so they can freeze the account and reverse charges. Then report the crime: the FBI Internet Crime Complaint Center at ic3.gov handles online card fraud, and the FTC takes identity theft reports. Save every report number you receive.

FAQ

Can I be arrested for visiting a CVV shop?

Visiting a site is not a charge by itself. Buying data, holding it with intent to use it, or using it to obtain goods or money are chargeable offenses, and crypto payments leave a trail.

Is selling my own card details a workaround?

No. Handing your card data to a third party still supports fraud, breaks your cardholder agreement, and leaves you on the hook for charges you cannot dispute. Banks close accounts over it.

Where can I report a site that sells card data?

Send the details to IC3 and to the card network fraud team. Visa, Mastercard, American Express, and Discover all accept reports. Never send payment or test the site with your own card.