What a CVV buyers list is
A CVV buyers list is a set of stolen payment card records. Each record holds a card number, an expiration date, and a card verification value. The CVV is the 3-digit code on the back of most cards, or the 4-digit code on the front of American Express cards. Card issuers use the code to confirm that the person entering the number holds the physical card.
The phrase appears in dark web forums, invite-only markets, and Telegram channels. Sellers call the files lists, bases, or dumps. The data comes from merchant database breaches, skimming devices on fuel pumps and ATMs, and phishing pages. Cardholders do not know the data is for sale.
Selling CVV Numbers: Why It Is Illegal and What Legitimate Card Work Looks Like
Why the term shows up in search
Traffic to the phrase comes from several groups. Cardholders check if their number is exposed. Fraud analysts, journalists, and researchers track market activity. Some visitors look for a list to use. Many sites that rank for the phrase resell old data, run affiliate schemes, or take payment and send nothing. Card data goes stale fast because issuers close compromised accounts and issue new numbers.
Federal law
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Subsection (a)(3) covers trafficking in stolen or counterfeit access devices. A first offense carries up to 10 years in prison and a fine. A prior conviction raises the maximum to 15 years. Federal sentencing guidelines adjust the term by loss amount and victim count. State statutes add separate charges for identity theft and larceny.
how to sell cvv to legit buyer
The Fair Credit Billing Act, at 15 U.S.C. § 1644, caps cardholder liability at $50 for unauthorized credit card charges. Debit cards fall under Regulation E. Liability for a debit card is $50 if the cardholder reports the loss within two business days, and up to $500 after that.
Scale and enforcement
The Department of Justice seized AlphaBay and Hansa in July 2017. Joker's Stash, a large card data market, closed in 2021. Blockchain analysis firms report that darknet market revenue fell after 2022. Takedowns do not remove the market. New sites open under different names within months.
Controls on card-not-present fraud
EMV chips generate a unique cryptogram per transaction. Tokenization replaces the 16-digit number with a network token for online merchants. 3-D Secure adds a verification step at checkout. Card-not-present fraud rose in the United States after the EMV liability shift in October 2015. Stolen static card numbers keep value where merchants do not require a code or a second factor.
Steps for a cardholder
- Lock the card in the issuer app or call the number on the back.
- Ask for a new card number, not just a new card.
- Read the last 12 months of statements for small charges.
- File a report at IdentityTheft.gov and with the FBI Internet Crime Complaint Center.
- Set transaction alerts above a low dollar amount.
Cardholders owe $0 to $50 for unauthorized credit card charges under federal law. The issuer, not the cardholder, absorbs the rest.