Short answer
No. Selling CVV data online is a federal crime in the United States, and no legitimate marketplace does it. The CVV is the three or four digit security code printed on a payment card. It exists so a merchant can confirm that the person paying has the physical card in hand. When someone offers to sell CVV numbers, they are selling access to an account that belongs to a cardholder who never authorized the sale. That is card fraud, and U.S. law treats it as a felony rather than a side hustle. Anyone promising that you can start selling CVV data "within minutes" is describing a criminal operation, not a business.
What a CVV actually is
Card networks built the CVV as an anti-fraud control. The number on the back of a Visa or Mastercard, or on the front of an American Express card, is not stored in the magnetic stripe or the chip. It is not supposed to be written down by merchants at all. Because it exists only on the physical card, a fraudster who has stolen a card number alone still cannot complete a card-not-present transaction without it. That design is exactly why stolen CVV data has resale value in criminal markets and why every card network, processor and issuing bank actively hunts for the people moving it.
Why selling CVV data is illegal
Federal prosecutors charge card data trafficking under 18 U.S.C. § 1029, which covers fraud and related activity in connection with access devices. A payment card account number, and the CVV that unlocks it, is an access device. Trafficking in unauthorized access devices, producing counterfeit access devices, and using them to obtain money carry criminal liability on their own, separate from any underlying theft. Attempted offenses count too, so an unfinished sale or an uncompleted cash-out does not remove the exposure. State law adds its own identity theft and computer crime charges on top.
Penalties you are actually looking at
- Felony convictions under § 1029 can bring substantial prison time, with aggravated cases involving large dollar amounts or multiple victims facing longer sentences.
- Forfeiture: proceeds, equipment, and funds tied to the offense can be seized.
- Restitution to issuing banks and cardholders for chargebacks and reissued cards.
- Permanent criminal record that closes off most jobs in finance, payments, and anything requiring a background check.
- Civil suits from card issuers, processors, and merchants who absorbed the losses.
Why the "within minutes" pitch is a red flag
The speed claim is a tell. Real payment businesses cannot onboard a merchant in minutes, because identity verification, underwriting, and anti-money-laundering checks take time. A seller promising instant CVV access is either fronting a marketplace that will take your money and disappear, or collecting your own identifying details for later extortion, or acting as an informant or undercover operation. Every one of those outcomes is worse than losing a few hundred dollars. There is no version of that transaction where you end up with a durable income source and no legal exposure.
What the card data rules require instead
If you run a business that accepts cards, the PCI Data Security Standard is the framework you must follow. It requires that sensitive authentication data, including the CVV, not be stored after a transaction is authorized, even in encrypted form. Storing CVVs is a violation whether or not a breach ever happens, and it is one of the fastest ways to lose your ability to accept cards. Merchants who need repeat billing use tokenization through their processor, which replaces card numbers with a reference that cannot be used outside that specific relationship.
Legal ways to work with payment data
There is real money in payments, just not in trafficking. Consider these paths:
- Become a registered merchant and run an actual product or service, then let a processor handle authorization.
- Work as a payment operations specialist, chargeback analyst, or fraud-prevention analyst at a bank, processor, or platform.
- Build software that integrates with a processor's tokenized APIs, using the sandbox test card numbers those processors publish for developers.
- Train for a PCI or security certification and audit or consult for merchants who need compliance help.
Note that test card numbers from processor sandboxes are synthetic and are not tied to any real account. They are the only card numbers you can freely copy and share, and they cannot be used to move real money.
If someone offered you CVV data
Do not buy, do not forward, and do not test the data against a live site, since testing it yourself is a separate offense. Preserve what you received, including usernames, wallet addresses, and message headers, and report it. In the U.S., internet-enabled financial crime can be reported to the FBI's Internet Crime Complaint Center, and card fraud and identity theft complaints can be filed with the Federal Trade Commission. If a card of yours is involved, call the issuer's fraud line immediately and ask for a new number.
FAQ
Can I sell CVV numbers I bought legally?
There is no legal retail channel that sells you CVV data, so any purchase is already unauthorized. Buying and then reselling it is trafficking in an unauthorized access device, and the "I paid for it" defense does not exist.
Is selling CVV data legal in other countries?
No major jurisdiction permits trafficking in stolen payment credentials, and cross-border transactions often add money laundering and computer misuse charges. A foreign host does not shield you from U.S. prosecution if U.S. servers, banks, or victims are involved.
Is there such a thing as a legal CVV marketplace?
Not for real card data. The only card numbers openly published are sandbox test numbers from processors, and they are designed to decline or simulate charges without touching an actual account.
What happens if I test a CVV I was given?
Running card numbers to see which ones work is card testing, which merchants and networks treat as an attack. It can trigger federal charges under the same statute and gets your IP, device, and payment accounts flagged quickly.