Selling CVV numbers is card fraud, not a business. A CVV is the short security code printed on a payment card, and trading those codes is trafficking in stolen payment data, which is a criminal offence in most countries. We do not explain how to do it and we do not help anyone find a marketplace for it. What follows is a plain explanation of what the term means, why the search leads only to legal trouble or to scams, and how legitimate shops handle card payments.
What a CVV actually is
CVV stands for card verification value. It is a three-digit code on the back of most Visa, Mastercard and Discover cards, and a four-digit code on the front of American Express cards. The code exists to prove that whoever is paying has the physical card in hand, which matters for phone, mail and online orders where no chip or PIN is used.
Because it is a security check rather than a payment credential, card networks and payment rules treat the CVV as sensitive authentication data. Under the PCI DSS standard, merchants are not allowed to store it after a transaction is authorised.
Why selling CVV data is a crime
Card numbers, expiry dates and security codes belong to the account holder and the issuing bank. Copying them and passing them to someone else is theft of payment data, and the law treats it that way. Depending on the country, that can fall under access device fraud, wire fraud, computer misuse, identity theft or money laundering rules, and the offence usually grows heavier when it is done at scale or across borders.
- Banks and card networks monitor card-not-present transactions and can flag or block compromised numbers within minutes.
- Payment processors keep device, IP and order records that investigators can request.
- Buying stolen codes carries the same exposure as selling them, and buyers have no legal way to complain when the codes do not work.
The supposed market is mostly a trap
People searching for how to sell CVV data usually picture a quick profit. In practice, the underground forums and chat channels built around this trade are dominated by ripoffs: codes that were cancelled before delivery, sellers who vanish after payment, and escrow accounts that exist only to collect deposits. Nothing about the arrangement can be enforced, because the underlying deal is illegal. That is why law enforcement agencies describe this activity as organised crime rather than an online side hustle.
If you run a greeting card or gift shop
Shops in this niche take a lot of small, card-not-present orders around holidays and occasions, which makes them a target for card testing. Sensible protections include:
- Use a PCI DSS compliant payment provider and let it handle the card fields on your checkout.
- Never store CVV data, and prefer tokenisation so your systems never hold full card numbers.
- Turn on 3-D Secure or an equivalent authentication step for higher-risk orders.
- Check billing address and delivery address mismatches, and watch for bursts of small orders with several declined attempts.
- Train staff to spot gift card and bulk order requests that arrive with unusual payment instructions.
How to report card fraud
If you have received stolen card data, or your own card details have been used, contact your card issuer first so the account can be frozen. Then report the incident to your national police and to the relevant cybercrime reporting body, such as the Internet Crime Complaint Center in the United States or the national fraud reporting service in your country. Reports help investigators link cases, even when a single loss looks small.
Legitimate questions behind the search
Most people who end up on pages like this actually want something lawful: how to accept card payments online, how to keep customer payment details safe, or what the CVV requirement means at checkout. Those are answerable questions, and they are the ones we cover. Selling CVV data is not a business plan, it is a criminal offence with a short shelf life.