Want to Sell CVV Data? That Is Card Fraud
Selling a CVV means selling the security code tied to someone else's payment card, and that is a crime in the US, UK, Canada, and the EU. A first federal offense under 18 U.S.C. § 1029 can bring fines and up to 10 years in prison. There is no licensed marketplace, no permit, and no workaround that makes it lawful.
If you searched this phrase, two paths sit in front of you. One leads to prosecution and a frozen bank account. The other is a real business that sells greeting cards, gifts, or gift cards and gets paid through a licensed processor. This guide covers the second path and the rules that shape it.
What a CVV Is and Why Nobody Can Sell It
The CVV (card verification value) is the 3-digit code on the back of a Visa, Mastercard, or Discover card, or the 4-digit code on the front of an American Express card. Card networks invented it to prove the person paying holds the physical card. The code belongs to the cardholder's bank relationship, not to whoever happens to read it.
PCI DSS Requirement 3.2 forbids storing sensitive authentication data, including the CVV, after a transaction is authorized. That rule binds every merchant and every processor that accepts cards. A shop that keeps CVV numbers in a spreadsheet fails its compliance review and loses the right to take cards at all.
What a Greeting Card or Gift Seller Should Do Instead
You can run a card and gift business for years without ever seeing a card code. Pick the model that matches what you actually sell.
- Sell your own products (cards, prints, gift boxes) and let a processor handle the card data.
- Sell gift cards you bought at face value. Resale is lawful in most US states, but retailer terms can void the balance, and both sides get scammed often.
- Use a marketplace such as Etsy, Faire, or Amazon Handmade, which owns the checkout and the compliance burden.
- Take cash or bank transfer at craft fairs if you want zero processing fees.
How to Take Card Payments Without Touching a CVV
The safe setup takes an afternoon. The steps below keep card numbers and codes out of your systems from day one.
- Open a merchant account with Stripe, Square, PayPal, or Shopify Payments.
- Use their hosted checkout page or payment link. Card data travels straight to the processor.
- Let the processor tokenize the card. You store the token, never the number or the code.
- File a PCI DSS Self-Assessment Questionnaire A, the shortest version, because your systems never hold card data.
Why the CVV Trade Is a Trap for Sellers Too
People who traffic in card data get caught in sting operations, and buyers face the same charges as sellers. Card networks flag and reverse fraudulent charges, so the money vanishes while the chat logs and payment trails stay. Banks, the FBI, and the Secret Service watch carding channels and build cases from them.
Red Flags to Watch For in the Cards and Gifts Trade
Fraud rings recruit small sellers because a real business account looks clean. These four patterns show up again and again.
- A "customer" asks you to run a card and send part of the money back. That is a money mule setup.
- Someone offers you a cut for processing a payment through your own account.
- A buyer wants to pay with a photo of a card or a code sent through chat. Real buyers use checkout pages.
- A supplier offers gift cards at 40% off face value. Stolen stock is the usual source.
Where to Report Card Fraud
Reports help banks close mule accounts and help police link cases.
- United States: the FTC's online fraud reporting tool and the FBI Internet Crime Complaint Center.
- United Kingdom: Action Fraud, the national reporting centre.
- Canada: the Canadian Anti-Fraud Centre.
Frequently Asked Questions
Is selling a CVV ever lawful?
No. A CVV identifies a payment card you do not own, so passing it to another person for money counts as trafficking in access devices. There is no consumer or merchant use case for buying one.
Can I sell gift cards I bought myself?
In most US states, yes. Resale sites such as CardCash and Raise handle the trade, and you typically get 70% to 90% of face value. Check the retailer's terms first, since some issuers void balances once a card changes hands.
What is the difference between a CVV and a gift card code?
A CVV proves you hold a payment card that draws on a bank account. A gift card code draws on a prepaid balance the retailer already holds. Both get stolen, but only a gift card balance can be resold by its owner.
How do greeting card sellers take payments without card data?
Use a hosted checkout from a payment processor. The processor sees the card number and the CVV, while you see an order confirmation and a payout.
Does storing CVV numbers cut chargebacks?
No. Storing CVV data breaks PCI DSS rules and raises your risk. Use Address Verification Service and 3-D Secure instead. Those tools fight fraud without holding sensitive data.
What should I do if someone asks me to sell CVV data?
End the conversation and report the request to your bank and to the fraud agency for your country. Keep the messages, since they help investigators trace the account behind them.