How to Sell CVV Online Safely and Legally
Discover the safest and legal ways to sell CVV online, including secure platforms and essential precautions.
CVV Dumps Online Store: What It Means and Why It Is Illegal
What "CVV dumps" means
A CVV dump is a record of stolen card data. The record holds the card number, the expiration date, the cardholder name, and the 3 or 4 digit security code. Some records add a billing address, a phone number, and the bank identification number. The word "dump" comes from the magnetic stripe data copied off a physical card.
An online store that sells CVV dumps is a criminal market. These sites run on the dark web or on invite-only forums. Buyers pay in cryptocurrency. Operators take a cut of each sale. No part of this trade is legal in the United States.
Federal statutes that apply
Selling stolen card data triggers several laws at once. Prosecutors file multiple counts from one transaction.
- 18 U.S.C. 1029 covers fraud and related activity in connection with access devices. A first offense carries up to 10 years. A second offense carries up to 20 years.
- 18 U.S.C. 1028A adds a mandatory 2 years for aggravated identity theft when the data belongs to a real person.
- 18 U.S.C. 1343 covers wire fraud. The maximum is 20 years.
- 18 U.S.C. 1956 covers money laundering when crypto payments move through exchanges.
Sentences run consecutive in many cases. A market operator who also sells data faces decades, not months.
How these storefronts operate
Most shops are automated. A buyer deposits crypto, picks a card brand and a country, and receives a record. Sellers leave ratings for each other to build trust. Sites close without warning and keep buyer deposits, a practice called an exit scam. Some shops are run by undercover agents.
Card data reaches these sites through skimmers on gas pumps and ATMs, phishing pages, and breaches at merchants. Banks cancel and reissue cards after each breach, so the inventory on a shop is short lived.
Penalties beyond prison
A conviction brings restitution to banks and cardholders, forfeiture of crypto and equipment, and fines. Card networks and issuing banks file civil suits. Victims sue under state identity theft laws. A federal conviction also blocks most banking and payment jobs for life.
Enforcement record
The FBI and the Department of Justice have seized domains and charged operators of several card and identity markets. The specific cases change each year. The pattern does not: agents buy from the shop, trace the crypto, and identify the admin. Data brokers who sell Social Security numbers and dates of birth face the same treatment.
If you find one of these sites
- Do not buy, log in, or send crypto.
- File a report with the FBI Internet Crime Complaint Center.
- Give the URL, the payment wallet address, and any screenshots.
If your card data appears for sale
- Call the issuer and close the card.
- Place a free credit freeze with all three credit bureaus.
- Check statements for small test charges, which often come before large ones.
- Use virtual card numbers for online purchases.
Figures on the size of the carding market vary by source. No public agency publishes a total. The FBI states that card fraud losses reach billions of dollars each year in the US.