Selling CVV numbers online is a federal crime in the United States. Card verification values, along with card numbers and expiration dates, are treated as access devices under federal law, and trafficking them for profit is prosecuted under 18 U.S.C. § 1029. A conviction can mean prison time, heavy fines, full restitution to victims, and a permanent criminal record.
Is it illegal to sell CVV numbers online?
Yes. Federal law defines an access device broadly to include card numbers, CVVs, PINs, and the account credentials tied to a payment card. Selling that data, whether you obtained it yourself or bought it from someone else, falls under the trafficking and possession provisions of 18 U.S.C. § 1029 when there is intent to defraud.
Is It Safe to Sell CVV Online? Risks, Laws, and Consequences
Three details surprise many people who ask this question:
avoid risks when selling cvv online guide
- You do not have to use the card yourself. Offering the data for sale is enough.
- Possession is a separate offense. Holding 15 or more access devices with intent to defraud is its own federal charge, and a batch of card records is easy to count.
- Buying is illegal too. There is no lawful side of the transaction, and buyers face the same statutes as sellers.
Which charges usually stack on top
Federal prosecutors seldom file a single count. A CVV case that runs through an online marketplace typically produces several charges:
legal risks of selling cvv online
- Access device fraud, 18 U.S.C. § 1029(a)(3) for trafficking and § 1029(a)(4) for possession.
- Conspiracy under § 1029(b)(2) if more than one person is involved.
- Wire fraud, 18 U.S.C. § 1343, because online sales cross interstate wires.
- Aggravated identity theft, 18 U.S.C. § 1028A, when a real person's identity is used or transferred.
- Money laundering, 18 U.S.C. § 1956, if proceeds move through bank accounts, prepaid cards, or cryptocurrency.
- State charges for theft, fraud, and identity crimes, which can be pursued separately from the federal case.
Penalties and sentencing
Statutory maximums for access device offenses range from 10 to 15 years in prison depending on the subsection charged, and fines for individuals can reach $250,000 under 18 U.S.C. § 3571. Courts also order restitution to banks and cardholders, impose supervised release after the prison term, and allow forfeiture of computers, phones, and any proceeds.
Actual sentences come from the Federal Sentencing Guidelines. Loss amount and the number of victims drive the offense level, and in card fraud those figures climb fast because a single stolen card can generate thousands of dollars in fraudulent charges. A defendant convicted of aggravated identity theft receives an additional two-year term that must run consecutively to the sentence for the underlying fraud.
How these cases get built
The U.S. Secret Service holds primary federal authority over access device fraud and works with the FBI, Homeland Security Investigations, and the U.S. Postal Inspection Service. Investigations often start with fraud reports from card issuers and payment networks, then move to undercover purchases, informants inside a marketplace, seized devices, and analysis of cryptocurrency transactions. International operations have led to arrests abroad and extradition to the United States.
Consequences beyond prison
- Restitution orders that follow you for years and are hard to discharge in bankruptcy.
- Civil lawsuits from banks and card issuers seeking the money they lost.
- Seized accounts, devices, and property bought with proceeds.
- A felony record that blocks many jobs, professional licenses, and housing applications.
- Immigration consequences, including removal from the country for non-citizens.
If you are already under investigation
Speak with a criminal defense attorney before talking to anyone. Statements made to investigators can be used against you, and deleting files or wiping devices after learning about an investigation can add an obstruction charge under 18 U.S.C. § 1519. A lawyer can explain the charges, whether a plea is worth considering, and what the guidelines range looks like in your case.
Bottom line
Selling CVV data online is a felony in the United States, not a gray-area side hustle. The transaction itself is the crime, charges stack across several statutes, and the penalties include prison, fines, restitution, and a record that stays with you.