Selling CVV data is a crime. A CVV is the three or four digit security code printed on a payment card, and anyone who trades those codes for money is dealing in stolen financial credentials. Card networks, banks, and police treat it as fraud, and there is no legal market for it.
What Is a CVV?
CVV stands for Card Verification Value. It is a short code that shows the person paying holds the physical card, which matters most for orders placed online or by phone.
- Visa, Mastercard, and Discover print three digits on the back, to the right of the signature strip.
- American Express prints four digits on the front, above the card number.
- The code is separate from the card number and the PIN, and it appears on no receipt or statement.
What Does "Sell CVV" Mean Online?
The phrase "sell CVV" comes from criminal forums where stolen card data is packaged and traded. Sellers list card numbers, expiry dates, and security codes, and buyers use them to place fraudulent orders.
Those listings are illegal, and they are unreliable for anyone foolish enough to buy. A large share of offers are bait, so the buyer loses money and gets nothing usable in return. Both sides commit fraud either way.
Why Is Selling CVV Data Illegal?
A CVV is part of a payment credential. Taking it without permission, copying it, or passing it on is theft, and selling it turns that theft into a commercial crime.
- Unauthorized use of a payment card falls under fraud and access device laws in the United States and similar statutes elsewhere.
- Moving money earned from stolen cards can add money laundering charges.
- Running a site that brokers card data adds conspiracy and trafficking counts for everyone involved, including hosts and payment processors who know what the site does.
What Are the Penalties for Card Fraud?
Penalties depend on the country and the amount taken. Courts in most jurisdictions can hand down prison terms, fines, restitution, and a criminal record that blocks many jobs and visas.
In the United States, aggravated identity theft carries a mandatory two year prison term on top of the sentence for the underlying fraud. Other countries apply their own fraud and computer misuse laws with similar weight.
Card-Not-Present Fraud in Plain Terms
When a card is not swiped or tapped, the shop cannot see the plastic. The CVV fills that gap, which is why it is the piece criminals want first.
Card-not-present fraud makes up a large share of reported card crime. Greeting card and gift stores see it often because digital orders ship fast with no signature and low values that slip past manual review.
How Banks and Processors Block CVV Misuse
Card networks built several checks that make stolen CVV data hard to use at a real checkout.
- CVV verification happens at authorization. A mismatch declines the transaction.
- PCI DSS rules bar merchants and processors from storing the CVV once a sale is approved.
- Tokenization swaps the card number for a random token, so a breach at a shop leaks nothing usable.
- 3D Secure sends the buyer to their own bank for a second check on high risk orders.
How Shoppers Can Protect Their Card Details
Most card fraud starts with a leak the cardholder never sees. A few habits close the common gaps.
- Never read your CVV aloud on a call you did not place, or send it by email, chat, or social media.
- Use a virtual card number from your bank for subscriptions and unfamiliar shops.
- Check statements each month and report charges you do not recognize.
- Freeze the card in your banking app the moment something looks wrong.
How Greeting Card and Gift Shops Cut Card Fraud
Small gift sellers get targeted because order values are low and volume is high, which hides fraudulent purchases in the noise.
- Use a PCI compliant payment processor and let it handle card data from start to finish.
- Require the CVV and the billing address on every online order.
- Turn on 3D Secure for orders above a set value.
- Never store CVVs, and keep them out of order notes, emails, and spreadsheets.
- Hold rush orders where the billing address does not match the shipping address.
- Train staff to refuse card details sent by message, since those requests come from scammers.
What to Do If Your Card Data Is Exposed
- Call the number on the back of your card and ask for the card to be blocked.
- Request a new card number, not a replacement with the same digits.
- Review recent transactions and dispute anything you did not buy.
- Report the theft to your local police and to your national fraud reporting body.
- Change passwords on shopping accounts that saved the card.
FAQ
Is buying a CVV legal?
No. Buying stolen card data is a crime in every country with card fraud laws, and the buyer commits fraud the moment the number is used.
Can you go to jail for selling card numbers?
Yes. Card fraud cases bring prison terms, fines, and restitution, and the sentence grows with the number of cards and the money taken.
Is a CVV the same as a PIN?
No. A CVV sits on the card and is used for online and phone orders. A PIN is a secret code you choose and type at a terminal or cash machine.
Why does a gift shop ask for a CVV?
The code shows the buyer holds the card. Shops ask for it to confirm the order is genuine, and a legitimate shop never keeps it once payment clears.
Where should I report a CVV offer I received?
Send it to your bank's fraud team and to your national fraud reporting service. Do not reply to the sender.