Can I Sell CVV on an Onion Site? No, It Is a Federal Crime

Short answer

No. Selling CVV numbers, card dumps, or full identity bundles is a federal crime in the United States. The law covers the act, not the network. A Tor onion site gets the same legal treatment as a public forum, a chat app, or a paper list.

tor marketplaces to sell cvv

Which law applies

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A card number, a CVV, a magnetic stripe dump, and an account PIN all count as access devices.

sell cvv on tor market

Subsection (a)(3) covers trafficking in access devices. It applies when a person, with intent to defraud, produces, uses, or traffics in one or more unauthorized access devices. The government must show intent to defraud. Selling card data to buyers who use it for fraud meets that test.

sell cvv on tor market

Other subsections cover related conduct. § 1029(a)(2) covers obtaining value of $1,000 or more in a one year period through unauthorized access devices. § 1029(a)(4) covers receiving access device records with intent to defraud. Charges often stack with 18 U.S.C. § 1028 (identity documents), § 1343 (wire fraud), and § 1956 (money laundering).

list of tor cvv shops for sellers

Penalties

§ 1029(c) sets prison terms of up to 10 years for most violations and up to 15 years for violations that involve certain factors, plus fines under 18 U.S.C. § 3571. Sentences rise with the loss amount, the victim count, and use of a computer network.

Tor does not create a legal shield

Tor is legal software. Using it does not make a sale lawful. Prosecutors charge marketplace operators and top sellers, not only buyers. The Department of Justice has announced charges against the alleged operator of Try2Check, a service that sold card validation checks to carding sites.

Payment trails remain the weak point. Exchanges, mixers, and hosting providers answer subpoenas. Chain analysis firms group wallets by owner. Undercover agents join forums and buy samples.

What the data is

"CVV" in these listings means one of three things: a three digit card verification value, a full card dump with track data, or a bundle of card data plus identity data. All three are stolen account credentials. Buyers use them for unauthorized purchases, and the issuing bank charges the loss back to the merchant or the cardholder.

If you run a real business

Card data has lawful uses: payment processing, fraud scoring, and chargeback prevention. Those uses run through contracts, PCI DSS controls, and processor agreements, not open listings. A merchant sells goods through an acquiring bank. A fraud vendor sells risk scores and device signals, not raw card numbers.

Where to check the rules

The FTC publishes guidance on card fraud and identity theft. The FBI runs the IC3 intake portal for cybercrime reports. The full text of § 1029 is on Cornell LII.