Dark Web CVV Markets: What the Public Record Shows
A dark web CVV market is an illegal service that sells stolen payment card records. The term CVV comes from the three-digit card verification value printed on a Visa, Mastercard, or Discover card, or the four-digit code on American Express. In carding, sellers use CVV as shorthand for a full record: card number, expiry date, cardholder name, billing address, and verification code.
Buying, selling, or using those records is a federal crime in the United States. No legal market exists for them. A buyer carries the same exposure as a seller.
Selling CVV Data Is Illegal: How Card Fraud Works and What to Do Instead
How the markets are structured
Most operations follow one of three patterns.
- Automated shops. A login, a balance, and a search form. Buyers filter by country, card brand, and issuing bank. Payment runs through cryptocurrency.
- Forums. Carding forums host vendor threads with escrow and reputation scores. Disputes go to a moderator.
- Chat channels. Telegram and Discord replaced many forums and shops after 2020. Listings appear as text or image files.
Most shops do not hold card data themselves. They act as resellers who buy from traffickers or breach groups. That layered supply chain is why one takedown does not end the ecosystem.
Prices reported in public research
Threat intelligence reporting has published price ranges for US card records. Common figures run from about $1 for a low-balance card to $30 or more for a card with a verified balance and full personal data. Records tied to premium banks or business accounts sell higher. Exact averages cannot be verified, and quoted numbers change from year to year.
Legal exposure in the US
18 U.S.C. § 1029 covers access device fraud. A first conviction carries up to 10 years in prison and a fine. A second conviction carries up to 15 years. 18 U.S.C. § 1028A adds a mandatory two-year sentence for aggravated identity theft, stacked on top of any other sentence. Prosecutors charge buyers, not only vendors.
Enforcement actions
Law enforcement has shut down several large operations. Joker's Stash closed in 2021. UniCC announced its shutdown in 2022. Genesis Market went offline in April 2023 in an operation led by the FBI and Dutch police, with 17 countries taking part. Each shutdown pushed activity to new platforms.
If your card data appears in a listing
- Contact your card issuer. Ask for a replacement card and a new number.
- Review statements for charges you did not make and dispute them in writing.
- File a report at IdentityTheft.gov. The FTC uses it to build a recovery plan.
- Place a freeze or fraud alert with the three credit bureaus if your Social Security number was also exposed.
Bottom line
Dark web CVV markets trade stolen financial data. The data is real, the crime is real, and the penalties fall on buyers as well as sellers. A person who finds their own card listed should treat it as confirmed fraud and act through their bank.