Short answer
Selling CVV numbers is illegal. A CVV is a security code tied to a payment card. Selling one means selling stolen card data. In the United States that is access device fraud under 18 U.S.C. § 1029. Buyers, sellers and brokers face fines and prison. No legal market exists for CVV data.
What a CVV is
CVV stands for card verification value. Visa, Mastercard and Discover print three digits on the back of the card. American Express prints four digits on the front. The code shows that the person holding the card has the physical card in hand.
Card networks treat the CVV as sensitive authentication data. PCI DSS, the payment card industry data security standard, bars merchants from storing it after a transaction is authorized. A seller who offers CVV numbers is offering data that no legitimate business keeps.
The law
18 U.S.C. § 1029 covers access devices. A payment card number counts as an access device. Trafficking in one or more access devices in a one-year period, with value of $1,000 or more, is a federal felony. Penalty ranges run from 10 years to 15 years in prison plus fines, depending on the offense.
Other countries take the same position. In the United Kingdom, the Fraud Act 2006 carries a maximum of 10 years. The Computer Misuse Act 1990 adds charges when a person takes card data from a system without permission.
What happens to sellers
Payment card fraud is investigated by the U.S. Secret Service, the FBI and local police. The FBI runs the Internet Crime Complaint Center. Card networks score transactions and flag patterns. Prosecutions often start with one cardholder dispute.
People who answer ads for CVV data often lose money. Common outcomes include nonpayment, resale of the same data to several buyers, and blackmail using chat records.
If you hold card data you should not have
Do not sell it, copy it or send it. Report the leak to the card issuer. The issuer can close the account and reissue the card.
If your own card data was stolen
- Call the card issuer. Ask for the card to be frozen.
- File a report at IdentityTheft.gov, the federal site run by the FTC.
- File a complaint with the FBI Internet Crime Complaint Center.
- Check statements for small test charges.
Legal ways to sell card-linked value
Unused gift cards can be sold through licensed gift card exchanges. Store credit and loyalty points sometimes transfer under the terms of the program. A credit card account itself cannot be sold. Selling a card account breaks the cardholder agreement and, once data is copied, federal law.