A CVV market is an online venue where people trade stolen payment card data, often listing card numbers together with the card verification value printed on the card. Buying, selling, or using that data without the cardholder's permission is a federal crime in the United States under 18 U.S.C. Section 1029, and there is no lawful version of these marketplaces. The sections below explain what the codes are, how the trade is prosecuted, and what a cardholder should do when card data leaks.
where to list cvv for sale online
What the CVV and CVV2 codes are
Card issuers print a verification code on every card. American Express uses a four digit code on the front. Visa, Mastercard, and Discover use a three digit code on the back, called the CVV2 or CVC2. The number exists to confirm that whoever is typing a card number also has the physical card in hand. It is not a password, it cannot be changed, and it is only meaningful when the cardholder is the one using it.
How the trade works
Stolen card data reaches these venues through breaches, skimming devices on fuel pumps and ATMs, phishing pages, and malicious software on a consumer device. Sellers then package the data and offer it to buyers through dark web forums or private messaging groups. Buyers use the data to make unauthorized purchases, order goods for resale, or load funds onto prepaid accounts. Every step in that chain is a separate criminal act, and investigators treat the marketplace itself as part of the conspiracy.
Federal and state penalties
Under 18 U.S.C. Section 1029, a first offense involving trafficking in unauthorized access devices carries up to 10 years in prison and fines, with penalties rising to 15 or 20 years when the offense involves larger losses or repeat conduct. Aggravated identity theft under 18 U.S.C. Section 1028A adds a mandatory two year consecutive sentence. States add their own charges for fraud, larceny, and computer crimes. Buyers who never touch a computer can still face charges, because possession of stolen card data with intent to use it is enough.
CVV Market on the Dark Web: A Comprehensive Guide
If your card data may be exposed
- Log in to your card issuer's app or website and freeze the card.
- Request a replacement card with a new number, expiration date, and verification code.
- Review at least 12 months of statements and flag every charge you do not recognize.
- Place a free fraud alert or credit freeze with the three nationwide credit bureaus.
- File a report at IdentityTheft.gov to get a personal recovery plan and an official record.
- Submit a complaint to the FBI's Internet Crime Complaint Center if a specific site or seller was involved.
- Change passwords on any shopping account that stored the card and turn on two factor authentication.
Warning signs of a marketplace selling card data
- Prices far below face value for gift cards, electronics, or travel.
- Payment accepted only in cryptocurrency, gift card codes, or peer to peer transfers.
- Claims of guaranteed approvals, test balances, or bulk card lists.
- No business registration, no refund policy, and no verifiable contact address.
- Pressure to act within minutes before an offer expires.
Any one of these signals is enough reason to walk away. A legitimate merchant never needs your card verification code outside a normal checkout, and no legitimate service sells card numbers in bulk.
How merchants and issuers cut exposure
Tokenization replaces the card number with a unique identifier, so a breach at the merchant yields nothing reusable. Address verification and 3 D Secure checks confirm that the buyer controls the account tied to the card. Multi factor authentication on customer accounts blocks the account takeover that so often precedes a card data dump. For consumers, the simplest defense is to keep the card in sight, avoid entering the number on unfamiliar sites, and read the privacy policy before saving a card to any account.