Short answer
Selling CVV data on the dark web for bitcoin is a federal crime in the United States. No legal market for card data exists. Every sale of another person's card number, expiration date, and CVV is a transfer of an unauthorized access device under 18 U.S.C. 1029. Bitcoin does not change the legal status of the transaction. A seller faces prison, restitution, and a felony record.
best dark web shops to sell cvv
What a CVV is
A card verification value is the 3 or 4 digit code printed on a credit or debit card. Banks use it to confirm that the person entering a card number is holding the physical card. The code belongs to the account holder and the issuing bank. It is not property that a third party can sell.
How to Sell CVV on the Dark Web via Tor
Federal statutes that apply
- 18 U.S.C. 1029, access device fraud. Covers producing, selling, and using card numbers, CVVs, and the equipment that encodes them.
- 18 U.S.C. 1028, fraud with identification documents. Applies when card data moves with names, addresses, or Social Security numbers.
- 18 U.S.C. 1028A, aggravated identity theft. Adds a mandatory 2 year term that runs after the sentence on the underlying count.
- 18 U.S.C. 1343, wire fraud. Applies to the messages, sites, and transfers used to arrange a sale.
- 18 U.S.C. 1956, money laundering. Applies when bitcoin from card sales moves through wallets or exchanges to conceal the source.
Prison terms and restitution
18 U.S.C. 1029 carries terms of 10 years on some subsections and 15 years on others, per count. A single indictment often lists several counts. The U.S. Sentencing Guidelines set the range from the loss amount, the number of victims, and the number of counts. Judges order restitution for the full loss under 18 U.S.C. 3663A. Prosecutors also seek forfeiture of devices, accounts, and crypto balances.
Bitcoin leaves a record
Bitcoin transfers are written to a public ledger that any party can read. Chainalysis, TRM Labs, and other firms sell tracing software to law enforcement agencies. Regulated US exchanges collect identity documents under the Bank Secrecy Act, so a conversion from bitcoin to dollars creates a record at a named business. Blockchain analysis has supported prosecutions of darknet vendors and market operators.
Money transmission rules
31 C.F.R. 1010.100 defines a money transmitter. A person who trades bitcoin for value as a business must register with FinCEN and follow state licensing rules. 18 U.S.C. 1960 makes an unlicensed money transmitting business a federal crime. Courts have applied it to crypto exchangers.
Costs to victims and merchants
Card issuers cancel the compromised card and issue a new one. Account holders dispute charges and wait for a provisional credit. Merchants absorb chargebacks and lose shipped goods. Small retailers carry the highest relative loss, because a single fraud order can erase the margin on many honest sales.
Reporting a card crime
Card holders report fraud to the issuing bank. Reports of identity theft go to the FTC through IdentityTheft.gov. Internet-facilitated card crime goes to the FBI Internet Crime Complaint Center. The U.S. Secret Service holds investigative authority over access device fraud and card skimming cases.