List of Tor CVV Shops for Sellers: A Comprehensive Guide
Discover the best Tor CVV shops for sellers in this detailed guide. Learn how to safely and legally sell CVV online.
Can I Sell CVV on an Onion Site? Federal Law Says No
Short answer
No. Selling CVV numbers is a federal crime in the United States. A CVV is an access device under 18 U.S.C. § 1029. Trafficking in access devices carries up to 10 years in prison and a fine up to $250,000 for one person. An onion site changes how the data moves. It does not change the charge.
What Section 1029 covers
The statute reaches the data and the sale.
- § 1029(a)(2): traffic in one or more unauthorized access devices in a one-year period and obtain $1,000 or more of value.
- § 1029(a)(3): possess 15 or more counterfeit or unauthorized access devices with intent to defraud.
- § 1029(a)(4): make, traffic in, or control device-making equipment.
- § 1029(a)(7): sell, give, or transfer a means of identification or a counterfeit access device to another person.
Charges stack. A CVV listing can also bring 18 U.S.C. § 1028 for identity theft, 18 U.S.C. § 1956 for money laundering of the payout, and 18 U.S.C. § 371 for conspiracy with a market operator or a card encoding partner.
Onion routing and jurisdiction
Tor hides the network path between two machines. It does not remove US jurisdiction over a seller who lives in the US. It does not stop a grand jury subpoena to a hosting provider, a domain registrar, or a crypto exchange. US prosecutors have charged darknet marketplace operators and carding forum administrators. Those cases are filed in US district courts.
Penalties at sentencing
Judges use the US Sentencing Guidelines. Loss amount, victim count, and computer use set the range. One count under § 1029 carries a 10-year statutory maximum. Restitution and forfeiture follow a conviction. Crypto and hardware can be seized.
Card data rules for lawful sellers
A merchant that accepts cards may keep the card number in limited cases. It may not keep the CVV after authorization. PCI DSS bans storage of sensitive authentication data after a transaction is authorized, encrypted or not. Issuers hold that data under their own controls. There is no licensed market where a third party sells CVV data. Software vendors and payment processors sell tokenization and fraud screening services. That is the lawful version of the same business problem.
If you are asked to sell CVV numbers
The request is a signal. Buyers on card markets use stolen data, and seller accounts are a target for exit scams. A seller in the US can be charged even when the buyer sits in another country, because the payment crosses a US server or a US exchange.
If your card data was sold
Call the issuer. Ask for a new card number. Check the card agreement for zero-liability terms. File a report with the FTC at IdentityTheft.gov and with the FBI Internet Crime Complaint Center at ic3.gov. Keep the report number.