Buying CVV Data Is a Federal Crime: No Legal Market Exists

Short answer

There is no legitimate place to buy CVV data. A CVV is a 3 or 4 digit code printed on a payment card. It exists to prove the physical card is present. Sellers who advertise CVVs on forums, chat apps, or paste sites are selling stolen account numbers or selling nothing at all. Both outcomes carry legal risk for the buyer.

What a CVV does

Card networks use the CVV to check that a card is in hand during a card-not-present transaction. The code is not stored on the magnetic stripe. Merchants who accept card-not-present payments are barred by PCI DSS from storing the CVV after authorization. That rule is why a working CVV list has no lawful source. The data can only come from a card, a cardholder, or a breached system.

Legal status in the United States

18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Payment card account numbers and CVVs fall under that statute. Trafficking in access devices carries a statutory maximum of 10 years for a first offense and 15 years for a later offense. 18 U.S.C. 1028A adds a mandatory 2 year term when identity theft is tied to another felony. A purchase of stolen card data can support charges of conspiracy under 18 U.S.C. 371.

State laws add charges. Most states criminalize possession of stolen card data and unlawful use of a scanning device.

Why the market is mostly fraud

• Escrow claims are unverifiable. The seller holds the funds.
• Sold numbers are often already blocked by the issuer.
• Some listings come from law enforcement operations or research honeypots.
• Buyers who complain have no recourse. Filing a complaint means describing their own crime.

Costs that fall on merchants and cardholders

Card-not-present fraud leads to chargebacks. A merchant pays the chargeback amount, a fee, and possible loss of processing rights. Cardholders spend time on replacement cards and dispute paperwork. Issuers absorb the rest and raise rates across the pool.

Legitimate tools that replace stored card data

1. Tokenization. The processor swaps the card number for a token. The merchant stores the token.
2. Network tokens from the card issuer, tied to a device or a merchant.
3. Virtual card numbers issued by a bank for one merchant or one spending limit.
4. Hosted payment fields that keep card data out of the merchant's systems.

If you find card data for sale

Report it. The FTC takes identity theft reports at IdentityTheft.gov. The FBI runs the Internet Crime Complaint Center at ic3.gov. A cardholder who sees an unknown charge should call the number on the back of the card and ask for the fraud line.

What this page does not cover

This page does not list vendors, prices, or payment methods for stolen card data. No such list exists in a lawful form.