Selling a CVV is credit card fraud. A CVV is the three or four digit security code printed on a payment card, and it belongs to the cardholder, not to anyone who sees the number. In the United States, 18 U.S.C. § 1029 makes the sale or transfer of card data a federal crime, with prison terms that reach 15 years for trafficking offenses.
Searching for ways to sell CVVs puts you in the same market as organized fraud rings. Those groups target people who ask this question. The realistic outcomes are a criminal charge or a scam that takes your money.
What Is a CVV, and Why Is It Not Yours to Sell?
A CVV is a security code that proves the person paying holds the physical card. Card networks issue two versions: the one encoded on the magnetic stripe or chip, and the one printed on the card for online orders.
Under PCI DSS, merchants may not store that code after a transaction is authorized. Not in a database, not in a log file, not on a receipt.
- Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID.
- It is 3 digits on most cards and 4 digits on American Express.
- It is not the card number, the expiry date, or the cardholder's PIN.
A "fullz" package bundles the card number, expiry, CVV, name, and address. Sellers advertise these on closed forums. Buyers who pay get stolen data or nothing at all.
What Happens If You Sell CVVs?
Penalties depend on the country, the number of cards, and the dollar amount involved. Most cases also bring restitution, asset forfeiture, and a criminal record that blocks banking and travel.
United States
18 U.S.C. § 1029 covers access device fraud. Trafficking counts carry up to 15 years in prison and fines under 18 U.S.C. § 3571. The Secret Service and the FBI investigate these cases, and they trace payments through crypto exchanges and payment apps.
United Kingdom
The Fraud Act 2006 covers possession and supply of articles for use in fraud, with a maximum of 10 years. The Proceeds of Crime Act lets courts seize assets tied to the offense.
Canada
Criminal Code section 342 covers unauthorized use of credit card data. The maximum is 10 years imprisonment on indictment.
Australia and the European Union
Australia's Criminal Code Part 10.2 targets dishonestly obtaining or dealing in personal financial information. EU members apply their own fraud and data protection statutes, and sentences in Germany and France often include prison time plus seizure of equipment.
Why "Sell Your CVV for Cash" Offers Are Scams
Nobody running a real card fraud operation recruits strangers through search results, chat apps, or social media messages. They already have suppliers.
- The "buyer" asks for a deposit, a verification fee, or a test transaction.
- They ask for your bank details, then use your account to move stolen money.
- They ask for a photo of your ID, then open accounts in your name.
- They promise fast cash and vanish once you pay or send data.
If you send your own card details, you become the victim. Your bank will reverse the charges, close the account, and note the fraud on your file.
Can You Ever Sell a CVV as a Legitimate Business?
No. Card processing does not involve selling codes. A merchant sends card data to a payment processor under a contract, and that transmission is not a sale of the data itself.
There is no licensed market for CVVs in any country with card fraud statutes. Brokers who trade in card numbers operate outside the law.
How Card Fraud Gets Traced
Card issuers score every transaction in real time. They compare the merchant, the amount, the device, the location, and the hour against the cardholder's normal pattern.
- Velocity checks flag many small charges in a short window.
- Device and IP fingerprinting link accounts that share hardware.
- Chargeback records feed issuer models, so a number used once gets blocked fast.
- Crypto payments are traceable through exchange records and subpoenas.
A stolen CVV has a short shelf life. Sellers know this, which is why they push buyers to act fast and pay upfront.
If You Run a Gift Shop or Greeting Card Store
Online gift stores are common targets for card testing attacks, where a fraudster runs small orders to check stolen numbers. Three habits stop most of it.
- Never store the CVV. Your gateway should capture it and discard it.
- Turn on address verification and CVV checks, and cancel orders that fail either check.
- Watch for bursts of small orders from one IP address or one email domain.
Compliant gateways such as Stripe, Square, and PayPal handle card data storage for you. If your checkout keeps the CVV in your own database, you carry PCI liability and the cost of a breach.
What to Do If You Found Card Data or Were Asked to Sell It
Do not use it, copy it, or send it to anyone. Using data that is not yours is the crime, even if you found it by accident.
- Report it to the card issuer or the merchant named on the card.
- File a report with the FTC at ReportFraud.ftc.gov or with your national consumer agency.
- In the US, send a complaint to the FBI's Internet Crime Complaint Center.
- If someone pressured you to sell data, save the messages and report the account.
FAQ
Is it illegal to sell a CVV?
Yes. Selling or transferring card data without the cardholder's consent is a crime in the US, UK, Canada, Australia, and across the EU.
Can I sell my own CVV?
Selling your own card data still exposes you to charges if the buyer uses it, and it breaks your cardholder agreement. Banks close accounts and can pursue you for losses.
What is a CVV shop?
A site that claims to sell card data. Most take payment and deliver nothing. The ones that do deliver are selling stolen numbers.
How do I report a CVV seller?
Send the site address, usernames, and payment details to the FBI IC3 in the US, Action Fraud in the UK, or your national cybercrime unit.
What is a legal way to earn money online instead?
Freelance work, reselling handmade goods, print on demand, and local services all pay without legal risk. Payment platforms ban accounts linked to card fraud, and that ban follows you to other providers.