How to Sell CVV Online: A Comprehensive Guide
Learn how to sell CVV online safely and legally with our detailed guide. Explore the risks, tools, and best practices involved in this niche market.
Card Validation Utility: Checksum, BIN and Limits
Short answer
A card validation utility checks the structure of a card number. It runs a checksum, compares the length and prefix against the ranges that payment networks publish, and can check the expiry date format. It cannot tell you if an account is open, funded, or has any balance. Only an authorization request through an acquirer reaches the issuer and returns an approval or a decline.
What a validation utility checks
1. Luhn checksum
Hans Peter Luhn at IBM described the algorithm in 1954. The utility reads the digits from right to left, doubles every second digit, subtracts 9 from any result above 9, and adds the total. A valid number gives a sum divisible by 10. The check catches single-digit typing errors and most adjacent transpositions. It does not prove the number was issued by anyone.
2. Issuer identification number
The first six to eight digits are the IIN, also called the BIN. ISO/IEC 7812 defines this prefix. A utility matches the prefix against published network ranges:
Card Check Utility: A Comprehensive Guide for Online CVV Sales
- Visa: starts with 4
- Mastercard: 51 to 55, and 2221 to 2720
- American Express: 34 or 37
- Discover: 6011, 65, or 644 to 649
The prefix identifies the network and the issuing bank. It does not identify the cardholder.
3. Length
ISO/IEC 7812 allows 13 to 19 digits. Visa issues 13, 16, and 19 digit numbers. Mastercard and Discover use 16. American Express uses 15. A utility flags a number with the wrong length for its prefix.
4. Expiry date
A utility can confirm the month falls between 01 and 12, and that the date has not passed. The printed date has no connection to account status.
5. CVV format
The CVV is three digits, or four for American Express. There is no public algorithm that ties it to the card number. No local utility can verify it. The issuer compares it during authorization.
What no validation utility can do
- Confirm the account exists or is open
- Return a balance or a credit limit
- Match the name or billing address
- Verify the CVV
- Report a lost, stolen, or blocked card
These limits are structural. The issuer holds the account record, and the networks do not expose it to a checksum tool.
Handling rules
Card numbers are cardholder data under PCI DSS. Version 4.0 requires encryption, truncation, or tokenization for stored numbers, and it prohibits storage of sensitive authentication data, which includes the CVV and full track data, after authorization. In the United States, 18 U.S.C. § 1029 makes it a federal crime to traffic in card numbers that belong to another person.