Guide to Selling CVV Cards on Online Forums
This guide provides essential information for those interested in selling CVV cards on legal forums.
Is There a Legal Way to Sell CVVs? No
Short answer
There is no legal way to sell CVVs. A CVV is the 3 or 4 digit code printed on a payment card or held in its chip data. The code proves the card is present. Selling a CVV means selling access to another person's card account. United States law bans that. No license, registration, or corporate structure makes a CVV sale legal.
Guide to Selling CVV Cards on Online Forums
What the law says
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. A card account number and its security code are access devices under the statute. Subsection (a)(2) covers trafficking in unauthorized access devices. Subsection (a)(3) covers the sale of access device records. Penalties under 1029(c) include fines and prison terms. The statute sets maximums of 10 years and 15 years, depending on the subsection.
State law adds charges. Most states treat card data trafficking as identity theft or computer crime. Federal sentencing guidelines raise the range with the number of cards and the dollar loss.
Where to Sell CVV Cards Without Scamming Others
Why "legal CVV" listings do not exist
- Card networks issue CVVs to cardholders. Only the issuer and the cardholder hold the code. A third party cannot transfer it.
- Marketplaces that list CVVs sell data from breaches, skimming, or phishing. The data is stolen by definition.
- Sites that promise "fresh" or "valid" CVVs also take payment and deliver nothing. Buyers lose money and have no legal remedy, because the deal is for an illegal good.
What legitimate businesses sell instead
Companies that handle card payments in the US work through one of three routes:
Legit CVV Card Selling Platform
- A merchant account with an acquiring bank. The business accepts payments for its own goods and services.
- A payment service provider or payment facilitator. The provider processes funds for many merchants under its own compliance program.
- Tokenization and card-on-file services from card networks and processors. The card number is replaced by a token. The CVV is not stored.
These routes require PCI DSS compliance, contracts, and underwriting. None of them involves selling card data to a third party.
Enforcement and reporting
Investigations come from the FBI, the U.S. Secret Service, and the Department of Justice. Reports go to the FBI Internet Crime Complaint Center and the Federal Trade Commission. Banks and card issuers run their own fraud units.
This page summarizes public law. It is not legal advice.