Answer

Selling a CVV for cash is a federal crime in the United States. A CVV is the 3-digit code on the back of a Visa, Mastercard, or Discover card, or the 4-digit code on the front of an American Express card. The code proves the person using the card number has the card in hand. Selling it, buying it, or holding it for an account that is not yours is access device fraud under 18 U.S.C. 1029. There is no licensed broker, no registration, and no contract that makes the sale lawful.

What a CVV is

  • Visa, Mastercard, Discover: 3 digits, back of the card.
  • American Express: 4 digits, front of the card. Amex calls it the CID.
  • Visa calls it CVV2. Mastercard calls it CVC2. The job is the same.

Card networks classify the code as sensitive authentication data. PCI DSS Requirement 3.2 bars merchants from storing it after a transaction is authorized. That rule is why a normal payment processor holds no stored CVV to leak in bulk. Data advertised as CVV stock comes from skimming, phishing, or a merchant breach, and each of those collection methods is a separate crime under the same statute.

The law

18 U.S.C. 1029 covers fraud and related activity with access devices. Subsection (a)(2) covers trafficking in unauthorized access devices. Subsection (a)(3) covers possession of 15 or more unauthorized access devices with intent to defraud. One card number can qualify. Federal statutory maximums under the section run from 10 to 15 years, based on the subsection and the loss amount.

18 U.S.C. 1028A adds a mandatory 2-year term, consecutive to any other sentence, when identity theft is used to commit the underlying offense. Sentencing uses the loss table in section 2B1.1 of the U.S. Sentencing Guidelines, plus enhancements for the number of victims.

Restitution and asset seizure

Courts order restitution to the issuer and to account holders. Prosecutors also seek forfeiture of bank accounts, devices, and proceeds tied to the offense. A felony conviction removes access to most payment industry jobs, since card networks and processors run background checks for handling cardholder data.

How cases start

Issuers score transactions in real time. A card used without the physical chip, in a new region, or at high volume trips a block and opens a case file. The FBI Internet Crime Complaint Center collects reports. The U.S. Secret Service holds jurisdiction over access device fraud. Postal Inspection handles mail-based schemes. Bank subpoenas and platform records link accounts to devices and payment rails.

Claims that do not hold up

Listings and chat offers that promise valid or fresh CVV data, escrow, or refunds describe the same offense. Those terms are not a defense. Banks reverse related transfers. Exchanges and payment apps comply with subpoenas.

Reporting

  • FTC: IdentityTheft.gov, or 877-438-4338.
  • FBI IC3: ic3.gov.
  • Card issuer: report the card and request a new number.

Bottom line

Commerce in card verification values carries prison time, restitution, and a felony record. Paid work with payment data exists in fraud prevention, compliance, and payment operations at licensed firms.