The short answer
If you are searching for a legit website that sells CVV data, the answer is that none exists. The CVV, or card verification value, is a three or four digit security code printed on a payment card. It is issued by a bank to one cardholder and it is not a product that anyone can license, resell, or distribute. Every site, forum, or chat channel that offers CVV numbers for sale is either trafficking in stolen payment credentials or simply taking money from people who think they are buying something. Both outcomes are bad, and only one of them also makes you a criminal.
This page explains what CVV data is, why the market around it is entirely illegal in the United States, how the scam side of that market works, and what to do if you want to sell something that involves card payments.
What a CVV actually is
A card verification value is generated when a card is issued and tied to the account number. Its purpose is to prove that whoever is typing the card details physically holds the card. Merchants are allowed to pass the code to the payment network for authorization, and the PCI Security Standards Council is explicit that the value must not be stored after the transaction is approved. That single rule tells you the whole story: the code is designed to be used once and forgotten, not collected and traded.
Why every "sell CVV" site is a fraud operation
There are only two kinds of operations behind these listings, and both are harmful.
- Stolen data brokers. The card numbers come from breaches, skimmers, phishing pages, or insider theft at a business that handled payment data. Selling them is a federal crime in the US under the access device fraud statute, and it is prosecuted regularly. Buyers are treated as participants in the scheme, not as customers.
- Straight scams. The seller never has any data at all. You send payment in cryptocurrency, then the account goes quiet, the escrow "voucher" never works, or you get a file of random numbers. There is no recourse, because you cannot report a stolen-data purchase to the police without describing your own crime.
Fake storefronts that look polished, show testimonials, or list uptime statistics are a standard pattern. The polish is the product. Reviews are written by the same people running the site.
The legal exposure, plainly stated
In the United States, knowingly buying or selling stolen payment card data can be charged as access device fraud, wire fraud, or identity theft, depending on what was done with the numbers. Sentences can include prison time and restitution, and a conviction follows you through background checks, banking, and employment for years. State prosecutors bring their own charges on top of federal ones. There is no small-claims path and no legitimate dispute process. If you are the buyer, you hold the liability and you have no protection.
What people usually want instead
Most searches for this term come from one of three real goals. The first is processing card payments for an actual business, which is done through a merchant account or a payment service provider after an underwriting review. The second is testing whether a card is valid for a legitimate subscription or checkout, which is handled by the card issuer or the payment processor. The third is learning how card fraud works for security or research purposes, which is covered by published standards, security certifications, and academic literature rather than by a vendor.
If a site promises any of those things by handing over live card codes, it is not a shortcut. It is a crime scene.
Warning signs to remember
- Payment accepted only in cryptocurrency, with no chargeback path.
- Claims of a "checker" or "balance validator" to confirm the data works.
- Prices quoted per card or per batch, as if card numbers were inventory.
- Escrow, vouches, or a "trusted seller" badge from an unverifiable forum.
- Urgency, limited stock, or a countdown timer on the checkout page.
- Any request for your own card details to "verify" you as a buyer.
FAQ
Is selling CVV data legal anywhere in the US?
No. Transferring payment card credentials you do not own, or that were taken without the cardholder's consent, is illegal under federal law regardless of the platform used.
Can a CVV site be shut down?
Yes, and many are. Sites move to new domains because they keep losing the old ones to seizures, host takedowns, and payment processor bans.
What should I do if I find one of these sites?
Do not send money or credentials. Report the listing to the payment platform hosting it and to the FBI's Internet Crime Complaint Center. If your own card data appears, contact your issuer right away.
How do I accept card payments for a real business?
Apply for a merchant account through a bank or a payment service provider. They will verify your business, set your rates, and handle the card data so your systems never touch a raw CVV.