Short answer
There is no legal place to sell CVV dumps. A card verification value dump is a payment card record copied from magnetic stripe data or from a merchant database. Selling those records is a federal crime in the United States. 18 U.S.C. § 1029 covers the sale, transfer, and possession of unauthorized access devices. A conviction carries up to 10 years in prison, or up to 15 years when the case involves 15 or more cards or $1,000 or more in value within a one-year period.
What a CVV dump contains
A dump holds Track 1 and Track 2 data from a card stripe. Fields include the primary account number, expiration date, service code, cardholder name, and CVV1. CVV2 is the three-digit code printed on the back of the card and used for card-not-present orders. Sellers in these markets also advertise "fullz," which adds a name, address, date of birth, or Social Security number to the card record. None of these markets hold a license from a US regulator, and none sit inside the payment system.
Federal statutes that apply
- 18 U.S.C. § 1029: sale, transfer, or possession of unauthorized access devices. Up to 10 years for a basic offense, up to 15 years with 15 or more devices or $1,000 or more in value in a one-year period.
- 18 U.S.C. § 1028A: aggravated identity theft. A mandatory 2-year term that runs after any other sentence.
- 18 U.S.C. § 1030: computer fraud, when the card data came from a hacked system.
- State statutes: most states charge card data possession as a felony.
How card data sellers get identified
- Undercover buys and informants inside the forum or chat group.
- Reports from issuers, processors, and card networks to the FBI, the Secret Service, and the Postal Inspection Service.
- Bank and crypto exchange records released under subpoena.
- Fraud scoring at issuers when card numbers are tested.
Where the money is not
Card data has no resale value in the legal economy. Merchants, issuers, and processors handle card records under PCI DSS with contracts, audits, and background checks. An employee who copies card data from a point-of-sale system commits a crime in the process. There is no employer, broker, or exchange that can buy it.
What to do if you find card data or a marketplace
Report it. The FBI Internet Crime Complaint Center takes tips on card fraud and card data trafficking. The Federal Trade Commission takes identity theft reports and routes them to law enforcement. Card issuers run fraud lines on the back of every card. Section 1029 also covers possession, so keeping stolen card data is a separate offense from selling it.
Common questions
Is there a licensed marketplace for CVV dumps?
No. No US regulator licenses the sale of stolen card records.
Do sellers on those sites stay anonymous?
Not in the cases that reach court. The Department of Justice has brought cases against operators of card data sites. Sentencing hearings produce public records with names and prison terms.
Does buying card data carry the same penalty as selling it?
The statute covers trafficking and, at 15 or more devices, possession with intent to defraud. Prosecutors charge buyers under the same section.