Can You Sell a CVV?
No. Selling a CVV is a crime in most countries, and no legitimate business buys or sells card security codes. A CVV is the 3 or 4 digit code printed on a payment card, and it exists to prove the card holder holds the card during a purchase. Anyone offering CVV data for sale is trading stolen card details.
What a CVV Is
The CVV (card verification value) sits apart from the card number and the expiry date. Visa, Mastercard, and Discover print a 3 digit CVV2 on the back of the card. American Express prints a 4 digit CID on the front.
Card networks added the code to cut online fraud. A thief who copies a magnetic stripe or reads a card number still lacks the CVV. That gap is why the code carries value on criminal markets and no use at all to a lawful shop.
Why Selling CVV Data Is a Crime
A stolen card number fails at checkout without the security code. Fraud rings know this, so they buy and sell CVVs to push online orders through other people's accounts. Police treat that trade as financial crime, not as a gray market.
Laws in the United States cover the trade through wire fraud, computer fraud, and identity theft statutes. The UK, Canada, Australia, and EU member states have matching offenses for possessing or trading stolen payment data. Aggravated identity theft in the US adds a mandatory two-year prison term on top of other counts.
What Card Network Rules Say About Storing a CVV
- PCI DSS Requirement 3.2 bars merchants from storing the CVV, full track data, or the PIN block after authorization.
- Encryption does not make storage legal. The rule covers encrypted and hashed forms of the code as well.
- Processors and gateways collect the code, check it, and hand your shop an approval or a decline.
- A notebook, spreadsheet, or order slip full of CVVs sets up a breach that you must report and pay for.
Keep the last four digits, the card brand, the expiry, and the authorization code instead. That set handles refunds and chargeback replies without holding anything sensitive.
How Greeting Card and Gift Shops Take Card Payments Safely
- Open a merchant account with a provider such as Stripe, Square, PayPal, or your bank.
- Send buyers to a hosted checkout page or a card terminal so the provider captures the card number, expiry, and CVV.
- Store only the last four digits, the card brand, and the transaction ID in your shop records.
- Match orders to payments inside your ecommerce or POS system, never in a shared spreadsheet of card data.
- Train staff to refuse any order that arrives with a CVV sent by email, chat, or text message.
What a Card Data Breach Costs a Small Shop
Card brands fine the acquiring bank, and the bank passes that cost to the merchant. A breach also triggers a forensic audit, card reissue fees, and the loss of your ability to take cards. For a shop with tight margins on greeting cards, that bill can end the business.
What to Do if Someone Offers to Sell You CVV Data
Refuse the offer and keep the message. Report it to your local police, and in the US to the FBI's Internet Crime Complaint Center. If the approach came through your shop's contact form, block the sender and check your checkout logs for small test orders.
FAQ
Is selling a CVV a crime?
Yes. Trading card security codes counts as fraud and identity theft in the US, UK, EU, Canada, and Australia. Sentences include prison time, fines, and restitution to the card holders and banks.
Can a shop keep a customer's CVV for repeat orders?
No. PCI DSS forbids storing the code after authorization, so a "save my card" feature must rely on a token from your processor. The token stands in for the card number and carries no CVV.
What is carding?
Carding is the use of stolen card data to buy goods or to test whether a card still works. Carders run small purchases first, then resell whatever they buy. A gift shop sees these as odd low value orders from distant addresses.
How do I spot a fraud attempt on a gift order?
Watch for mismatched billing and shipping addresses, rush shipping on a large order, and several cards failing before one works. Address Verification Service and 3D Secure checks stop most of these attempts. When in doubt, call the buyer at the number listed on the order.
What happens if a fraudulent order goes through?
The real card holder files a chargeback, and the bank pulls the funds back from you. You also lose the goods, the shipping cost, and a chargeback fee from your processor. Fast shipping rules and manual review of first-time buyers cut those losses.