Where to Sell CVV on Tor: A Comprehensive Guide
Discover the risks and legality surrounding the sale of CVVs on the Tor network and learn how to stay safe. This guide provides a comprehensive overview of the market, risks, and safety precautions.
Can I Sell CVV on an Onion Site? No, It's Federal Fraud
No, you cannot sell CVV data on an onion site. Selling card verification values that belong to someone else is carding, and in the United States it is charged as access device fraud and identity theft. The question "can I sell CVV on an onion site" has a short legal answer: it is a crime, and the network you use does not change that.
What a CVV is, and why it is not yours to sell
A card verification value is the short numeric code that confirms the physical card is in the buyer's hands during a card-not-present transaction. It belongs to the cardholder and the issuing bank. When another person obtains that code and offers it for sale, the data is stolen by definition. Offering it on a marketplace is trafficking in an unauthorized access device under 18 U.S.C. § 1029, whether or not a single buyer pays.
Payment networks also prohibit merchants and processors from keeping CVV data after a transaction is authorized, so a vendor holding a large stock of valid codes is holding something no legitimate business is allowed to store.
Does an onion site make CVV sales legal or safe?
No. Tor routes traffic through relays, but it does not rewrite criminal law, and it does not make a transaction untraceable. Carding markets have repeatedly been seized or shut down after investigations, and US and international agencies have placed investigators inside those forums. Sellers also face the practical risks that come with the market itself:
- Escrow operators and admins disappear with balances.
- Buyers dispute orders and post seller details publicly.
- Crypto payments can be traced through blockchain analysis.
- Logs, chat history and device identifiers survive on seized hardware.
Penalties under federal law
Access device fraud is a felony, and statutory maximums for the relevant counts run into multiple years, with higher exposure for aggravated conduct. A related charge under 18 U.S.C. § 1028A for aggravated identity theft carries a two-year term that must run consecutively to the underlying sentence. Cases often add restitution, asset forfeiture of wallets and equipment, and supervised release after prison.
What typically happens to people who sell card data
Most sellers never reach the payout stage. Buyers receive dead or cancelled numbers, demand refunds, and expose the seller. Where funds from stolen cards move through an account, additional money laundering counts can follow. Prosecutors treat carding as organized financial crime, and a single seized marketplace can generate charges against hundreds of accounts.
Legal ways to work with payment data
- Run an e-commerce business and accept cards through a licensed payment processor.
- Work in fraud prevention, risk operations, or chargeback analysis at a bank or merchant.
- Join PCI DSS compliance, tokenization, or payment security teams.
- Do authorized security research through a bug bounty program with a written scope.
- Become an authorized reseller or independent sales organization for a payment provider.
Each of these paths pays for payment expertise without exposing you to federal charges, and several of them hire people who understand how card fraud works.
If you are already involved or being pressured
Stop communicating with forum contacts and speak with a criminal defense attorney licensed in your state. Report stolen card data through the FTC's identity theft reporting process and the FBI's Internet Crime Complaint Center. Both accept complaints from the public and can document that you came forward first.