Selling CVV data is a federal crime

A CVV is the 3 or 4 digit code printed on a payment card. The code proves the card is in hand at checkout. When someone sells CVV data online, the product is stolen payment credentials. That trade falls under 18 U.S.C. 1029, which bans the sale, transfer, and possession of unauthorized access devices. A first conviction carries up to 10 years in prison and a fine. Trafficking in 15 or more devices raises the maximum to 15 years.

read more

What "CVV website lists" on Reddit are

Reddit's content policy bars transactions in stolen goods. Subreddits that advertise card data get removed. Accounts get suspended. Search results that claim to list "verified CVV shops" fall into three groups:

CVV Selling Websites in 2025: Why They Are Illegal and What to Do Instead

  • Scams. The seller takes crypto and sends nothing, or sends numbers that banks canceled.
  • Honeypots. Some pages collect buyer details for investigators.
  • Copies of old lists. Stolen card data has a short shelf life. A card gets canceled after the first chargeback, often within hours.

Why the market fails

Card issuers run authorization checks at the point of sale. A card reported stolen gets blocked. Data resold to several buyers triggers several declined charges on one account. That pattern produces a fraud case fast, and card networks share the data with issuers.

more on this topic

Legal exposure for sellers and buyers

  1. Buying counts as possession of unauthorized access devices. The charge does not require a completed purchase.
  2. Payment trails. Crypto exchanges file suspicious activity reports with FinCEN.
  3. Wire fraud and mail fraud charges can stack on top of the access device charge.

What to do instead

If a card number of yours appears for sale, call the issuer and request a new card. Report the listing to the platform and to the FBI Internet Crime Complaint Center. FTC Consumer Sentinel data shows identity theft reports above 1 million per year, and payment card fraud is a large share. A thread that promises "fresh CVV" is a fraud vector, not a storefront.

How to Sell CVV Dumps Online: A Comprehensive Guide