Selling CVV data has no legal marketplace. A CVV is the three or four digit verification code printed on a payment card, and selling, buying, or trading that code is card fraud in every jurisdiction this guide can speak to. If you came here looking for a place to sell CVV numbers, the direct answer is that no such legitimate venue exists. Sites that advertise one are usually scams aimed at the seller, or fronts run by investigators. This guide explains the term, the legal exposure, and what to do instead, with a focus on people who run greeting card shops, gift shops, and small online stores.
What a CVV is and why it cannot be sold
A CVV is a security feature, not a product. Card networks added it so that someone reading a card number alone could not complete a transaction. The code is tied to the account, and the account belongs to the cardholder and the issuing bank. Nobody else can transfer it, license it, or sell it. Any listing that offers CVV data for sale is offering stolen account credentials. There is no invoice, no contract, and no consumer protection on the other side.
- Pros of walking away: no criminal record, no chargebacks traced to you, no bank account frozen during an investigation.
- Cons of engaging: federal charges, civil liability to issuers, and a permanent paper trail in chat logs and payment records.
Legal exposure and enforcement
In the United States, trafficking in stolen payment card data falls under identity theft and access device fraud statutes, and penalties scale with the number of accounts involved. Equivalent laws exist in the UK, Canada, the EU, and most other markets. Investigators work from the buyer side as often as the seller side, which means a first sale can be the last one before charges. Card issuers also pursue civil recovery for fraud losses.
Why offers to buy CVV data reach small gift shops
Owners of card and gift shops sometimes get messages asking to "sell" customer card data, or offering a cut for terminal access. These messages target small merchants because they assume weaker controls. Treat any such message as a fraud attempt and report it. The same applies to anyone who asks you to run a card through your terminal and hand over the receipt.
If you run a card or gift shop: protecting payment data
- Use a payment processor that handles tokenization, so your systems never store the full card number.
- Keep terminals updated and restrict who can access them.
- Never write card numbers or CVVs on paper orders, gift notes, or order forms.
- Reconcile chargebacks and refunds on a set schedule so odd activity shows up fast.
- Train seasonal staff on what to do when a customer asks for a manual card entry.
What to do if someone asks you to sell card data
- Do not respond or negotiate.
- Save the message, username, and any payment details they shared.
- Report it to your local police and to your national cybercrime reporting body.
- Tell your payment processor if the request involved your terminal or account.
Legitimate revenue for card and gift shops
Selling physical goods is legal and profitable. Greeting cards, gift wrap, gift cards you are authorized to resell, custom printing, and gift baskets all generate revenue without touching other people's account data. If you want to add a digital line, sell your own designs or print-on-demand items rather than anything tied to payment credentials.