Can I Sell CVV Online Legally? U.S. Laws & Penalties

If you need a direct answer first: No, you cannot legally sell CVV numbers online in the United States. The CVV/CVC is a security code that proves the person using a card has the physical card in hand. Selling it to a third party outside the legitimate payment flow is the core behavior behind card-not-present fraud. Federal law, state fraud statutes, card-network rules, and payment card industry standards all treat that sale as illegal or prohibited, even if you did not personally steal the card.

more on this topic

The Short Answer

Selling a card security code without the cardholder's and card issuer's authorization is a federal access-device crime. The code alone is an access device when used to move money or buy goods. There is no lawful generic marketplace where strangers buy bulk CVV codes, and claims that a listing is a “legal test card” or “newly issued” do not change how law enforcement reads the transaction.

Selling CVVs Online: The Legal Reality and Safe Alternatives

When Selling CVV Becomes a Federal Crime

Federal investigators look at whether the sale involves an “unauthorized access device” and an intent to defraud. That generally happens when:

online cvv selling marketplace

• You obtained card data through a data breach, phishing, skimming, or from a carding shop.
• You advertise or sell “fresh CVV,” “fulls,” “dumps,” or “logs,” which are carding-marketplace terms.
• You sell card numbers, CVVs, or other card credentials to someone you know intends to use them without the cardholder’s consent.
• You are a company or employee that moves lawfully received card data into a sale or disclosure to an unauthorized party.

United States Secret Service and federal prosecutors pursue these cases under 18 U.S.C. § 1029, which covers fraud and other activity involving counterfeit or unauthorized access devices.

Can You Sell CVV Data Online? What Legitimate Sellers Need to Know

Penalties and Enforcement You Can Face

A conviction for trafficking in unauthorized access devices can lead to a multi-year prison sentence, fines, restitution to card issuers and victims, and forfeiture of the money and equipment used in the scheme. The exact sentence depends on how many devices, how much loss, and whether identity theft or aggravated identity theft charges apply. Do not assume that using cryptocurrency, encrypted chats, or foreign servers protects you; the DOJ and Secret Service routinely take down card shops and arrest vendors across state lines.

PCI DSS and Card Network Rules

Even if you are a registered business, the Payment Card Industry Data Security Standard (PCI DSS) prohibits storing sensitive authentication data like the full CVV/CVC after authorization. Visa, Mastercard, American Express, and Discover also prohibit merchants from reselling cardholder data under their operating regulations. In practice, legitimate processors will terminate any merchant account suspected of selling CVVs and report the activity to the card brands and fraud investigators.

“But I Didn’t Steal the Cards” Doesn’t Change the Law

A merchant or employee who did not hack the cardholder still becomes a participant in fraud if they sell card data to someone who will misuse it. The law considers you an accomplice or a trafficker, not a neutral broker. A written disclaimer saying “buyer must be legal” or “for education only” also will not shield you when the product is clearly cardholder security data and the buyer’s intended use is obvious.

What If the CVV Belongs to Your Own Card?

Selling your own card's CVV is not a viable legal business. A buyer has no legitimate reason to pay for your CVV unless they intend to use your card in a way you should not authorize. Once you share that code, you also lose your ability to control charges, and you can be declined for chargebacks because the transaction may look authorized through your own sharing.

Legitimate Alternatives if You Handle Card Data

If you want to work with payment technology, legal routes exist:

• Build a fraud-prevention tool that checks whether a card entry is valid and flags CVV mismatches through approved card-brand testing programs.
• Work as a compliance specialist, PCI DSS auditor, or risk analyst for a payment processor.
• Run a merchant business that involves card payments and follow the rules for using CVV as a one-time verification, never as something you sell or store.

For anyone who has accidentally received stolen card data, the lawful step is not to test it or promote it but to delete it if it is not part of a pending legitimate transaction and to report the exposure to your company’s fraud contact or law enforcement. Talking to a criminal defense attorney before you contact law enforcement is also a reasonable step if you believe you are already involved in a card-data incident.