Selling CVV and fullz is card fraud
CVV means card verification value, the three or four digit code printed on a payment card. Fullz means a bundle of a cardholder's personal data: name, address, card number, expiration date, security code, and sometimes a Social Security number or a login. A person who sells CVV fullz sells stolen payment and identity data. US law treats that sale as a federal crime. No legal market exists for it.
The buyer gets data it cannot enforce. The seller gets a felony charge. Both sides risk money and prison time.
What the terms mean
- CVV: the code on the card. Merchants use it to check that the physical card is present.
- Fullz: a full identity package tied to one card.
- Dumps: card data copied from a magnetic stripe.
- Carding: use of stolen card data to buy goods or move money.
The law
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. It makes it a crime to traffic in one or more unauthorized access devices, and it covers card numbers, account numbers, and the codes that unlock them. A first offense carries up to 10 years in prison. Aggravated cases carry up to 15 or 20 years.
18 U.S.C. § 1028 covers identity documents and authentication features. 18 U.S.C. § 1028A adds a mandatory two year term in cases that involve aggravated identity theft. State law adds separate charges. Most states treat possession of multiple card numbers as its own offense.
Where the data comes from
Card data leaves a cardholder in a few ways: skimming devices on terminals and ATMs, breaches at merchants and processors, phishing pages that copy checkout forms, and malware on point of sale systems. Each source is also a federal crime. Data sold in bulk on carding forums comes from these sources in part, and a share of it is fabricated to defraud the buyer.
Risk to the buyer
- The card is often blocked or already reported at the time of sale.
- Forum vendors take payment and ship nothing.
- Forum accounts, wallet records, and chat logs become evidence in prosecutions.
- Deliveries tied to stolen cards lead back to an address.
If your card data is exposed
- Call the card issuer. Ask for a replacement card with a new number.
- Place a freeze on your credit file with Equifax, Experian, and TransUnion. A freeze costs nothing.
- File a report at IdentityTheft.gov to get a recovery plan.
- File a complaint with the FBI Internet Crime Complaint Center at ic3.gov.
- Read card statements for small test charges.
Reporting a seller
Send details to the FBI IC3 and to the fraud unit of the card issuer. The US Secret Service also investigates payment card fraud. Keep screenshots and message logs. Do not send money to test a seller.