There is no legitimate place to sell CVV data online, and this guide will not point you to one. A CVV, the three or four digit verification code tied to a payment card, is a security credential that belongs to the cardholder and the issuing bank. Buying, selling, or brokering those codes is trafficking in stolen financial credentials. In the United States it falls under 18 U.S.C. Section 1029, which criminalizes the production, sale, and transfer of unauthorized access devices, with penalties that include prison time and fines. Hosting providers, domain registrars, and payment processors routinely act on abuse reports, so the "marketplaces" that advertise themselves this way are usually either law-enforcement operations, exit scams, or fronts that collect your own data and money.
Why CVV marketplaces do not work as a business
The economics are stacked against anyone trying this. Card issuers can void a compromised card number within minutes of a fraud report, so inventory expires faster than it can be sold. Buyers in these channels have no recourse and no reputation system that survives a single dispute, which is why chargeback-style disputes among criminals end in doxxing rather than refunds. Every step, from the forum post to the crypto payout, leaves a trace that financial-crime units and card networks actively monitor.
- Stored CVV data is prohibited by PCI DSS after authorization, so even legitimate merchants cannot keep it, let alone resell it.
- Card networks run continuous transaction monitoring that flags bulk authorization attempts within hours.
- Crypto payouts on these channels are traceable through blockchain analysis used by investigators.
What actually happens to people who try
Cases filed under 18 U.S.C. 1029 commonly involve seized devices, frozen accounts, restitution orders, and supervised release. Cooperating witnesses are frequently the buyers and sellers in the same forum, which is why these operations unravel quickly once one participant is arrested.
Lawful ways to earn from cards and digital goods
- Resell unused gift cards through established, licensed exchange platforms that verify balances with the issuer.
- Become a registered payment facilitator, ISO, or merchant-services reseller, where commissions come from signed merchants rather than stolen data.
- Run a storefront for your own digital products, such as templates, courses, or software, and use a mainstream processor.
- Work in fraud prevention, chargeback analysis, or trust and safety, fields that hire people who understand how card fraud works.
- Offer consulting on PCI DSS readiness for small merchants who need help scoping their cardholder data environment.
If a merchant wants to handle card data properly
Work with a PCI-compliant processor, use tokenization or hosted fields so raw card numbers never touch your servers, and never store the verification code. That keeps you inside network rules and out of the criminal statutes that cover credential trafficking.
If someone asked you to sell CVV data
You can report the solicitation to the FBI Internet Crime Complaint Center or the FTC. If your own card was compromised, contact your issuer first, then file a report so the pattern is documented.