Short answer
There is no legitimate method for selling CVV data, and no guide can make one. A CVV is a security value printed on a payment card and used to prove the person entering card details actually holds the card. It is issued by a bank to a specific cardholder. Selling it means selling someone else's account credentials, which in the United States is prosecuted as access device fraud under 18 U.S.C. § 1029. The people who run the forums and marketplaces that advertise this trade are typically either law enforcement, scammers who take payment and deliver nothing, or criminals who will later use a buyer's own identity against them.
How to Sell CVV Cheap: A Comprehensive Buying Guide
What a CVV actually is
The card verification value is a short numeric code, three digits on most Visa, Mastercard and Discover cards and four on American Express. It is not stored on the magnetic stripe or the chip, and PCI DSS forbids merchants from retaining it after a transaction is authorized. That design exists precisely so that a stolen card number alone is not enough to complete a card-not-present purchase. If a CVV is being sold, it was obtained through a data breach, a skimmer, a phishing page, a fake storefront, or an insider at a merchant. In every case the data belongs to a cardholder and an issuing bank, not to whoever is offering it.
What U.S. law says
- 18 U.S.C. § 1029(a)(3) criminalizes trafficking in access devices, which covers selling card numbers and verification values.
- Penalties under § 1029 reach up to 10 years for a first offense and 15 years for subsequent offenses, plus fines, and higher maximums apply when the offense involves more than a certain number of devices.
- 18 U.S.C. § 371 covers conspiracy, so agreeing with others to run the scheme adds a separate charge.
- 18 U.S.C. § 1343 wire fraud applies to the online communications and payment transfers used to arrange sales.
- Money laundering statutes apply when proceeds are moved through cryptocurrency, prepaid cards, or third parties.
- State law adds identity theft and computer crime charges on top of the federal counts.
How these cases get built
Investigators rarely need to guess. Card networks flag bulk authorization attempts. Issuers see the chargeback pattern and report it. Breach forensics ties stolen numbers back to a specific merchant. Payment processors and crypto exchanges keep records. Blockchain analytics firms trace wallet clusters even across mixing services, and undercover agents routinely operate inside the same channels buyers use. A single seized device or cloud account can produce years of chat logs and transaction records.
how to sell cvv without getting caught
What the forums do not tell you
- Listings are frequently fabricated, resold, or already dead cards that get declined instantly.
- Escrow offered by the forum is controlled by the same people who run the forum.
- Buyers are common targets for doxxing and extortion after a first payment.
- Even a single completed transaction can establish the elements of a federal offense.
Legitimate work in the same space
The skills people associate with this trade are marketable lawfully. Fraud analytics, chargeback and dispute analysis, payment risk operations, PCI DSS compliance auditing, security engineering, and authorized penetration testing all pay well and carry no criminal exposure. Security researchers who work with card data do so under written authorization, inside a defined scope, and usually with tokenized or synthetic data rather than live numbers.
If you are a merchant or a cardholder
- Never store the CVV or full track data after authorization.
- Use tokenization so your systems never hold a raw card number.
- Enable 3-D Secure or an equivalent authentication step for card-not-present orders.
- Review velocity and geolocation rules on your checkout.
- Cardholders should report unauthorized charges to the issuer immediately and file a report with the FBI Internet Crime Complaint Center.
The honest version of this topic is short: selling CVV data is a felony, the buyers and sellers are frequently each other's victims, and the only durable career path in payment security runs through compliance and fraud prevention work, not through marketplaces.