Where to Sell CVV on the Darknet: A Comprehensive Guide
Discover the darknet marketplaces where CVVs are bought and sold, and learn how to stay safe while navigating this risky terrain.
Selling CVV Data: Federal Law and Penalties (US)
Short answer
There is no safe way to sell stolen card data, including CVVs. In the United States, buying, selling, or transferring payment card numbers and verification codes without the cardholder's consent is federal access device fraud under 18 U.S.C. § 1029. This page does not explain how to do it. It states the law and the penalties.
Where to Sell CVV on the Darknet: A Comprehensive Guide
What a CVV is
A CVV is a 3 or 4 digit code printed on a payment card or generated for a digital wallet. Card networks use it to confirm that the person paying holds the physical card. Merchants may not store it after authorization. A CVV alone is not a credential a cardholder can lawfully hand to a stranger.
Federal law
18 U.S.C. § 1029 covers producing, selling, transferring, and possessing access devices and device-making equipment. It also covers trafficking in the means used to obtain card data. Penalties include fines and prison terms of up to 10 years, with longer maximums for certain conduct. Courts can order forfeiture of proceeds and equipment after a conviction.
State law and civil claims
Most states have their own identity theft and financial transaction card statutes. Issuers and cardholders can sue for losses. Card networks also fine and ban merchants and processors tied to data handling failures.
Detection
Issuers run models on transaction velocity, geolocation, device fingerprints, and merchant category. Card networks operate cross-border fraud reporting systems. Payment processors file suspicious activity reports with the Financial Crimes Enforcement Network. Investigators use controlled buys and account takeovers.
What to do instead
Report stolen card data to the card issuer and to the FBI Internet Crime Complaint Center. Report identity theft at IdentityTheft.gov. If you handle card data as a merchant, follow PCI DSS requirements and never store CVV values after authorization.