There is no legitimate market for selling a CVV. A CVV is the three or four digit security code printed on a payment card, and offering one that belongs to someone else is payment card fraud. For a greeting card or gift shop, the practical version of this question runs the other way: you do not sell CVVs, you keep them out of your systems and you train staff to recognize the messages that promise easy money for card data.
What a CVV actually is
The code is generated by the card issuer and printed on the card. Card networks use it to verify that whoever is typing card details has the physical card in hand. Under the PCI Data Security Standard it counts as sensitive authentication data, which means a merchant may pass it to a processor for one authorization and may not keep it afterward. It is not inventory, not a file, and not something a business can own.
Why "sell CVV" searches lead to scams
Most people who search this term are targets rather than operators. The pitches arrive by chat app, forum message, or spam mail and follow a small number of patterns.
- Bulk files of card numbers with a CVV attached, sold for a flat fee.
- Claimed access to a fresh batch after a data breach.
- Escrow offers through a third party who disappears once payment lands.
- Test cards offered free to prove the seller is real.
What happens next is predictable. Either the buyer sends money and receives nothing usable, or the buyer receives stolen records and becomes the person holding them when investigators trace the transaction. Both outcomes are bad, and only one of them involves a criminal charge.
The legal exposure, in plain terms
Trafficking in payment card data is treated as access device fraud and wire fraud under federal law, and most states carry their own identity theft and computer crime statutes.
- Prosecution, with fines and restitution attached to each count.
- Loss of the ability to hold a merchant account, which ends online selling for most small shops.
- Civil claims from banks and cardholders who absorb the loss.
- A record that follows you into any future application for credit or employment.
Two legitimate options for a gift shop that needs fewer fraudulent orders
If the real problem is chargebacks on gift orders, these are the controls that work, with the trade-offs spelled out.
Option 1: Card verification and address verification at checkout
Turn on the CVV and address checks your gateway already provides, and set rules that decline orders where both fail.
- Pros: no extra software cost, runs inside card network rules, filters the highest-risk orders before capture.
- Cons: false declines on orders shipped to a recipient at a different address, which is common for gifts.
- Cons: rules need tuning after each holiday peak or the decline rate creeps up.
Use this when you ship physical greeting cards, hampers, or gift boxes and most of your orders come from repeat customers.
Option 2: Manual review of high-value and rush orders
Hold any order above a set value, and any order with overnight shipping, for a short review before fulfillment.
- Pros: catches the bulk gift card and expedited orders that fraudsters favor, and costs nothing beyond staff time.
- Pros: review staff learn the patterns fast, which improves judgment across the whole team.
- Cons: slows fulfillment, and it stops scaling past a few hundred orders a day.
- Cons: results drift without a written checklist.
Use this when you run a small studio with sharp seasonal peaks such as December, Valentine's Day, and Mother's Day.
A short checklist for the shop floor
- Never store the CVV after authorization. PCI DSS treats it as data you may not retain.
- Tokenize card details so your systems hold a reference, not the number.
- Flag gift card orders that ask for overnight delivery and a handwritten note.
- Keep a written escalation path for any message offering to buy card data or sell it to you.
- Report attempts to the FBI Internet Crime Complaint Center and to your processor's fraud team.
Bottom line
Anyone offering to sell you a CVV is offering you evidence. The work worth doing sits on the other side of the counter: verify the card, review the odd orders, and keep the code out of your database.