Short answer
Selling CVV data is illegal in the United States. No legitimate business sells card verification values. Listings that promise "instant PayPal" delivery are not connected to PayPal. PayPal does not sell card data. Most of these listings are advance-fee scams. Some are law enforcement operations.
What a CVV is
A CVV is a 3 or 4 digit code. Visa, Mastercard, and Discover print three digits on the back of the card. American Express prints four digits on the front. The code proves the person entering a card number holds the physical card. Card networks call it CVV2, CVC2, or CID, based on the issuer. PCI DSS prohibits merchants from storing this code after an authorization. That rule narrows where a leak can start: skimming devices, point-of-sale malware, and phishing pages, not merchant databases.
Why "instant PayPal" claims do not hold
PayPal does not sell card numbers and does not run CVV marketplaces. A seller who advertises "instant PayPal" uses the brand to signal speed. The phrase describes the payment channel the seller wants, not a product from PayPal. Transactions move through cryptocurrency, gift cards, or peer-to-peer apps. None of those channels return funds once the buyer sends value. Chargeback protection does not exist for illegal purchases. A buyer cannot report the loss to a bank without admitting to a crime.
What federal law says
18 U.S.C. § 1029 covers fraud in connection with access devices. Trafficking in card numbers carries up to 15 years in prison. Producing, selling, or transferring the data carries up to 10 years for a first offense and 20 years for a second. 18 U.S.C. § 1028A adds a mandatory 2 years when the offense involves identity theft. Those 2 years run in addition to any other sentence. Fines can reach $250,000 for an individual. The Department of Justice prosecutes these cases at the district level. Undercover agents operate storefronts and forums, so a buyer can become the target of an investigation from the first message.
What happens to buyers
Common outcomes: the seller takes payment and stops replying; the data is expired or blocked; the cardholder files a chargeback; the buyer's accounts and IP logs become evidence. Card issuers void a transaction when fraud is reported. The buyer holds no remedy and no refund path.
If your card data is exposed
- Call the issuer and ask for a new card number. A new CVV comes with it.
- Review statements for small test charges, often under $5.
- File a report at IdentityTheft.gov and keep the confirmation number.
- Report the listing to the FBI Internet Crime Complaint Center.
- Under 15 U.S.C. § 1643, credit card liability caps at $50. Debit card liability depends on how fast you report the loss.
Bottom line
There is no legal market for CVV data. The phrase "sell CVV online for PayPal instant" describes an offer that breaks federal law and, in most cases, takes money from the person who responds to it.