Is selling CVV data for PayPal legal?
No. Selling CVV data for PayPal is a federal crime in the United States. A card verification value is a security credential tied to a cardholder account, and trading one without the cardholder's consent falls under access device fraud, identity theft, and wire fraud statutes.
There is no legitimate marketplace that sells CVVs for PayPal. Sites that advertise it are moving stolen data, reselling numbers that were already burned, or running an advance-fee scam against the person they recruit.
Which laws cover CVV trafficking?
- 18 U.S.C. 1029 covers access device fraud, including the sale, transfer, and possession of card numbers and CVVs. A first offense carries up to 10 years, and repeat or aggravated cases reach 15 to 20 years.
- 18 U.S.C. 1028A adds a mandatory two-year consecutive sentence when identity theft is tied to the fraud.
- 18 U.S.C. 1343 covers wire fraud when the scheme crosses state lines or runs over the internet.
- State prosecutors add charges for larceny, computer trespass, and possession of stolen financial records.
Why do sell-CVV listings usually target the seller?
Most ads that recruit people to sell CVV data are bait aimed at the recruit, not the cardholder. The pitch requires a fronted "verification fee," a "cashout deposit," or a test transaction before any payout is released.
The money moves out and nothing returns. Because the recruit was trying to broker stolen card data, reporting the loss exposes them to criminal liability, which is exactly why these schemes select for people who cannot call the police.
How do PayPal and card issuers detect stolen credentials?
PayPal and the card networks score each transaction on device fingerprint, IP reputation, velocity, and mismatches between billing data and cardholder records. Card testing, where small charges confirm whether a CVV is live, trips velocity rules within minutes.
Issuers can force a chargeback on any charge later proven unauthorized. Accounts tied to those transactions get frozen, and the balance is held until the dispute resolves.
What happens to people convicted of CVV fraud?
Sentences under 18 U.S.C. 1029 reach 10 years for a first offense and fines up to $250,000 for an individual. Courts also order restitution to the issuers and merchants, plus forfeiture of the devices and funds used in the scheme.
Aggravated identity theft stacking under 1028A adds two years that must run consecutively, so a card-fraud conviction plus an identity-theft count produces a longer term than either charge alone.
How do you report CVV or PayPal card fraud?
- Call the card issuer using the number on the back of the card and ask for the fraud department.
- File a report at IdentityTheft.gov, which produces a recovery plan and an FTC affidavit.
- File a complaint with the FBI Internet Crime Complaint Center if a platform or online seller is involved.
- Report the listing to the host site, app store, or forum carrying it.
- Notify PayPal directly if a PayPal account was used to move the funds.
How do you protect your own PayPal account?
- Turn on two-factor authentication and use an authenticator app rather than SMS.
- Review transaction history weekly and set alerts for every charge.
- Never share a CVV, one-time code, or password with a buyer, seller, or support caller.
- Freeze your credit with all three bureaus if your card data was exposed.