What Is a Dark Web CVV Trading Site List?
A dark web CVV trading site list is a catalog of criminal marketplaces and chat channels that claim to sell stolen credit and debit card numbers, along with the cardholder's CVV code. Every entry on those lists points to illegal activity. Buying, selling, or using that card data is a felony in the United States under 18 U.S.C. § 1029.
What These Lists Claim to Sell
Vendors on those markets package stolen payment records in tiers, using their own slang to signal quality. The pitch sounds specific, which is part of the lure.
- Card numbers with CVV. The card number plus the 3-digit verification code (4 digits for American Express).
- "Fullz." Card data bundled with the victim's name, billing address, phone number, and sometimes a Social Security number.
- BIN ranges. Bank Identification Numbers sorted by issuer, country, or card type.
- "Cashout" instructions. Steps for turning stolen numbers into goods or cash, which are a separate crime on their own.
Prices run from under a dollar per record to a few hundred dollars for bundles. Sellers set those prices themselves, and no outside party checks anything they claim.
Buying Guide: Dark Web CVV Trading Sites with Bitcoin
Why Buying CVV Data Is a Federal Crime
US law treats stolen card data as contraband, not as a product. Trafficking in it carries prison terms that reach 10 years for a first offense and longer for aggravated counts.
- 18 U.S.C. § 1029 covers fraud and related activity with access devices, including producing, selling, or possessing stolen card numbers with intent to defraud.
- 18 U.S.C. § 1028A adds a mandatory two-year sentence, served after any other term, when identity theft is tied to the offense.
- 18 U.S.C. § 1343 (wire fraud) applies when the internet, phone, or email carries the scheme.
Federal sentences can include restitution to victims and to the banks that absorb the loss. State prosecutors file their own charges on top of that.
Why Most CVV Trading Sites Are Scams
The people running these markets break the law against people who are breaking the law to buy from them. That is a market with no contracts, no refunds, and no police.
- No escrow that means anything. Forum moderators who "guarantee" a deal are often the same people selling the records.
- Dead cards. An issuer freezes a compromised card soon after a test charge, so the data goes stale.
- Recycled data. The same record gets sold to dozens of buyers before anyone notices.
- Bait listings. Some sites exist to collect buyer details, crypto wallets, and IP addresses, then resell or blackmail.
A "valid rate" of 70 percent, quoted on a vendor page, is a claim from the vendor. There is no way to verify it.
How Stolen Card Data Reaches Those Markets
Card numbers do not appear on the dark web by accident. They get there through theft methods that consumers can defend against.
- Skimming hardware placed on gas pumps, ATMs, and self-checkout lanes.
- Phishing pages and fake checkout screens that copy card details from a lookalike site.
- Merchant data breaches where stored card records are copied.
- Malware on a home computer that reads keystrokes or browser form data.
- Phone scams where a caller poses as a bank fraud department and asks for the CVV.
Signs Your Card Number Is Being Traded
Card fraud often starts with a small charge that tests whether the number works. Watch for these signals.
- A charge of $1 or less from a merchant you do not recognize.
- Purchases in a state or country you have never visited.
- A replacement card arriving when you did not request one.
- Fraud alerts, or a sudden drop in your available credit.
How to Protect Your Card Data
- Use virtual card numbers for online shopping when your issuer offers them. Each merchant gets a one-time number tied to your real account.
- Turn on purchase alerts so every transaction hits your phone.
- Check statements each week instead of each month.
- Pay with a chip, tap, or a mobile wallet at the terminal instead of swiping a magnetic stripe.
- Give your CVV only on a checkout page you reached by typing the merchant's address yourself.
- Freeze your credit at Equifax, Experian, and TransUnion. It is free and does not affect your score.
What to Do If Your Card Data Is Stolen
- Call the card issuer and ask them to freeze the account.
- Dispute every charge you do not recognize, and put the dispute in writing.
- Report the theft at IdentityTheft.gov, which builds a recovery plan and a pre-filled FTC affidavit.
- File a report with your local police and keep the report number.
- File a complaint with the FBI's Internet Crime Complaint Center if the fraud came through an online scheme.
Frequently Asked Questions
Can you be arrested for visiting a CVV trading site?
Browsing alone is not the core of the offense. Buying the data, downloading it in bulk, or using a card number that is not yours is. Investigators also trace the payment side, so crypto transfers for stolen records create evidence.
Is any dark web CVV site list legitimate?
No. Legitimate merchants never sell raw card numbers. Card data moves through payment processors that must follow PCI DSS, and those rules forbid storing the CVV after a transaction is authorized.
Do the cards on these lists actually work?
Some may work for a short window. Most are already blocked, sold many times over, or posted as bait. Either way, using one is a crime with a paper trail that leads back to the buyer.
What is a CVV code?
The CVV is the 3-digit security code on the back of most Visa, Mastercard, and Discover cards, and the 4-digit code on the front of American Express cards. It exists as an anti-fraud check, which is why card issuers and processors treat it as restricted data.
Where can you report card fraud in the US?
Start with your card issuer, then file at IdentityTheft.gov through the FTC and with the FBI's IC3. A local police report gives you a case number that banks and credit bureaus accept as proof.