Request declined
I will not write a buying guide for card CVV data. CVV numbers are payment credentials. They belong to the cardholder and the issuing bank. They are not a product.
What the law says
In the United States, 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Selling, transferring, or possessing card numbers with intent to defraud carries prison terms and fines. Penalties rise with the number of devices and the value of the loss. Similar statutes exist in the EU, the UK, Canada, and Australia.
How the market works
Card data sold on forums and chat channels is usually stolen. Sellers take payment in cryptocurrency. Buyers receive numbers that may already be cancelled, already used, or issued to a cardholder who will dispute the charge. Buyers also hand over identity and payment data to the seller. That data gets resold. Arrests in carding cases commonly follow the buyer, not the seller.
What happens to buyers
Banks reverse fraudulent charges. Merchants report them. Card networks and law enforcement share data. A buyer who tests a card leaves a payment trail, a shipping address, and a device fingerprint.
Legitimate options
If you need card numbers for testing, payment processors and card networks issue test cards. Stripe, Adyen, and Braintree publish test card numbers for sandbox use. These are free and legal.
If the aim is selling greeting cards or gifts, the tools are different: a payment processor account, a fraud filter, and address verification. I can write about those.