Sell CVV: Short Answer
"Sell CVV" describes offering card verification values for sale. That trade is carding, and it is a crime in the United States, the United Kingdom, the European Union, Canada, and Australia. A CVV is not inventory. It is authentication data tied to one payment card and one cardholder. No merchant, gift shop, or greeting card seller can sell it.
What a CVV Is
A card verification value is a short code printed on a payment card. Visa, Mastercard, and Discover cards carry three digits on the back. American Express cards carry four digits on the front. The issuer generates the code and links it to the card number and the expiry date.
The code exists to prove the physical card is present during a card-not-present transaction. A person who knows only a card number and expiry date cannot complete an online order on most gateways without it.
Why the Phrase Appears Online
Search results for "sell cvv" come from three sources. First, carding forums host stolen card data listings. Second, scam sites sell fake or expired codes to buyers and keep the payment. Third, SEO spam pages harvest traffic and redirect it.
None of these sources are legitimate vendors. Prices quoted on such pages, often a few dollars per record, describe stolen data, not a product line.
Legal Status
In the United States, 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Trafficking in card data carries fines and prison terms, with penalties rising for repeat offenses. The Fraud Act 2006 covers equivalent conduct in the UK. EU member states criminalize the same acts under national penal codes.
Card networks also act. A merchant that stores CVV data after authorization loses the ability to accept card payments.
What Merchants Must Do
PCI DSS requirement 3.2 states that sensitive authentication data must not be stored after authorization. That data set includes the CVV, the full magnetic stripe, and the PIN block.
Card-not-present merchants, including gift card sellers and online greeting card shops, use these controls instead:
- Hosted payment fields so the CVV never touches the merchant server
- Tokenization to replace the card number with a surrogate value
- Address Verification Service checks on the billing address
- 3-D Secure challenges for higher-risk orders
- Rate limits and manual review on gift card bulk orders
Gift Cards and Greeting Cards
Gift cards attract fraud because they are easy to resell and hard to trace. A thief who buys gift cards with a stolen card number does not need to sell the CVV. The gift card itself becomes the resale item.
For shops in this niche, the practical result is stricter order review on digital gift cards, lower per-order value caps, and delayed delivery for first-time buyers.
If You Find a CVV Listing
Report it. In the US, file a complaint with the FBI Internet Crime Complaint Center and the FTC. Tell the card issuer if your own card number appears in a listing. Cardholders in the EU can report to the issuing bank and to the national data protection authority.
Nothing about a CVV listing is a business opportunity. It is evidence of a crime.