The short answer
In the United States, buying card data you are not authorized to have is a federal offense, and it gets charged that way. The core statute is 18 U.S.C. § 1029, access device fraud. Most subsections carry up to 10 years in prison; others carry up to 15, plus fines, restitution, and forfeiture. Conspiracy to violate that section carries the same maximum as the underlying crime. If account holder names or identity documents come bundled with the card, prosecutors can stack identity theft counts on top, and aggravated identity theft under § 1028A adds a mandatory two years that runs after any other sentence. Courts have narrowed when that statute applies, but it still lands in a lot of these cases.
What catches people off guard is how little it takes. You do not have to use the card. You do not have to profit. Under § 1029, "traffic" is defined to include obtaining control or custody of a device, so the purchase itself can be the charged act.
What actually gets charged
Possession thresholds
Possessing 15 or more counterfeit or unauthorized access devices is a stand alone offense under § 1029(a)(3) with a 15 year maximum. Sellers ship in batches, so one order can cross that line without the buyer ever counting.
cvv dumps buying guide for first time buyers
Wire fraud and money laundering
Payment usually moves through crypto or a processor. Prosecutors add 18 U.S.C. § 1343 wire fraud, which carries up to 20 years, and 18 U.S.C. § 1956 money laundering when funds pass through layered accounts. Those counts add exposure even if the card sits unused in a file.
Common Mistakes Before Buying CVV and How to Avoid Them
Conspiracy
Under § 1029(b)(2) and 18 U.S.C. § 371, an agreement alone is punishable. Chat logs, forum posts, and shop account records are the evidence. The government does not have to prove the scheme worked, only that you joined it.
Sentencing: the loss number drives everything
Federal sentencing guidelines under § 2B1.1 set the range by loss amount and victim count, not by what you paid. Courts have treated the intended loss and the charges run on the stolen accounts as the relevant figure, and that can be many multiples of the purchase price. Restitution follows the same math, and the court can order forfeiture of crypto, devices, and accounts. A $50 order can produce a loss figure in the tens of thousands.
State charges and civil suits
Nearly every state has its own identity theft and unauthorized access statutes. Some set the possession threshold lower than federal law, and state prosecutors file alongside federal ones or take cases the U.S. Attorney declines. On a different track, issuing banks, payment networks, and the individual cardholder can sue for the fraud losses and for the damage to their credit.
Collateral consequences people forget
- A felony conviction removes gun rights under 18 U.S.C. § 922(g) and can end professional licenses and security clearances.
- Non citizens face removal and inadmissibility, which can shut down any path to a green card or citizenship.
- Background checks reach federal records, so the conviction follows you into housing and job applications.
- Supervised release, travel limits, and monitoring are common after prison.
The shops themselves
The stores selling this data are run by the same crews that steal it, and buyers get robbed often. Typical outcomes include payment sent to a wallet that never delivers, malware hidden inside a "checker" tool, and the buyer's own bank and identity data harvested at checkout. Some operations are fronts for law enforcement or for a rival group collecting buyer logs.
If you are already in it
If a federal agent contacts you, the advice from defense attorneys is consistent: say nothing, do not explain, and ask for a lawyer before answering anything. Early statements are the ones used against you. Entrapment claims rarely work, because the government only has to show predisposition, and joining a shop or forum does that for them.
Bottom line
The legal risk of buying CVV data is not a ticket or a slap on the wrist. It is a federal felony charge with a real prison range, a restitution order tied to losses you did not personally cause, and consequences that outlast the sentence. The exposure starts at the moment of purchase, not at the moment of use.