What the term means
A CVV is the security code printed on a payment card. Most US Visa and Mastercard products use three digits on the back. American Express uses four digits on the front. Merchants and banks check that code to confirm a card is present at the point of sale.
A "CVV market" is a site, forum, or chat channel that sells card data. Listings combine a card number, an expiration date, a CVV, and sometimes a cardholder name, billing ZIP code, and bank name. Sellers advertise "fullz," "dumps," and "CVV" as product types. None of these operations hold a money transmitter license, a payment processor agreement, or any other authorization. The goods are stolen card records.
Where the card data comes from
Card data reaches these markets through a small number of channels.
where to list cvv for sale online
- Skimming devices attached to gas pumps, ATMs, and self-checkout terminals
- Malware installed on retail point-of-sale systems
- Phishing pages and fake login screens that capture card details
- Data breaches at merchants, processors, and travel or health companies
- Insider theft by employees with access to payment records
Stolen records get bundled and resold many times. A single card number can appear in dozens of listings. A buyer in these markets pays for data that another buyer used first.
Finding CVV Buyers on the Internet: A Guide
Legal status in the United States
18 U.S.C. § 1029 governs access devices, the legal category that covers credit cards, account numbers, and CVV codes. The statute makes it a federal crime to produce, sell, transfer, or possess access device data with intent to defraud. A first conviction under most subsections carries up to 10 years in prison. Aggravating factors raise the maximum to 15 or 20 years. Courts can also impose fines and restitution.
State laws add charges for identity theft, computer crimes, and larceny. Prosecutors can stack federal and state counts.
Buyer risk
Card data sold on these sites is invalid in a large share of cases. Numbers are canceled, spent, or tied to accounts with fraud alerts. Sellers post fake screenshots and use escrow terms that exist only inside the site's own software. Money sent by cryptocurrency or gift card does not come back.
Buyers also expose themselves to the operators. A person who sends a name, address, or wallet identifier to a criminal marketplace has handed personal data to strangers. Some operators resell that data or use it for extortion.
Consumer harm and reporting
Cardholders in the US are protected by zero liability policies from the major networks. The cardholder calls the issuer, the charge is reversed, and the bank or merchant absorbs the cost. Merchants pay chargeback fees, and banks raise prices to cover losses.
The FBI's Internet Crime Complaint Center logged 859,532 complaints in 2024 with reported losses of $16.6 billion. Card fraud sits inside that total.
Reports go to the card issuer, the FTC's IdentityTheft.gov service, and the FBI's Internet Crime Complaint Center. A local police report helps when a person needs documentation for a bank dispute.
What to do if an offer appears
Any direct offer to sell card data is either a fraud attempt or evidence of a crime. There is no legitimate version of this transaction. The correct action is to ignore the message, block the sender, and report it. Email providers and the FTC accept reports of unsolicited offers.