Short answer

A CVV sale moves a card verification value from one person to another. US law has no legal version of that trade. The code belongs to the bank that issued the card. Selling it, buying it, or holding it with intent to defraud falls under 18 U.S.C. 1029, access device fraud. The phrase "for financial gain" describes the intent element. Prosecutors must show intent to defraud. Profit motive is the evidence that proves it.

cvv sale for financial compensation

What the code is

Card networks print a 3 or 4 digit value on the card. Visa calls it CVV2. Mastercard calls it CVC2. It sits apart from the card number, the magnetic stripe data, and the chip data. Merchants ask for it when the card is not present, such as a phone order or a web checkout. PCI DSS Requirement 3.2 bars merchants from keeping it after a transaction authorizes.

related article

Why the listings are often fake

Because PCI DSS forbids storage of the CVV2, a breached merchant database does not hold the codes. Breaches yield card numbers, names, and expiration dates. A seller who claims to hold CVVs in bulk has one of two sources: values typed in by hand, or invented values. Buyers pay in advance through a method that cannot be reversed, and they have no recourse. The trade itself is a crime, so no court will enforce the deal. Card issuers decline the charges the buyer runs. Public reporting on carding forums describes non-delivery as a common outcome. Reported validity rates from card-checking services vary, and no audit confirms them.

more on this topic

Federal exposure

• 18 U.S.C. 1029(a)(2): trafficking in unauthorized access devices that yields $1,000 or more in a 12 month period. Up to 10 years.
• 18 U.S.C. 1029(a)(3): possession of 15 or more unauthorized access devices with intent to defraud. Up to 10 years.
• 18 U.S.C. 1028A: aggravated identity theft. A mandatory 2 year term that runs after the sentence for the underlying felony.
• 18 U.S.C. 1029(b)(2): conspiracy. Up to half the maximum term for the underlying offense.
• 18 U.S.C. 3663: restitution to the banks and cardholders who absorbed the loss.

State charges

Every state has a law on payment card fraud or identity theft. A state case can run on its own. Federal and state prosecutors decide who files.

related article

How investigations start

Issuers run fraud scoring models on each authorization. A cardholder dispute starts a chargeback. The issuer traces the order to a device, an IP address, and a shipping address. Postal inspectors open a case when goods move through the mail. Complaints filed with IC3 reach the FBI and local task forces. Agents also work inside the forums where these listings appear.

Reporting

Call the card issuer first. That stops the charges. File a complaint with the FBI Internet Crime Complaint Center and the FTC. Keep the report number. A police report supports the bank's fraud claim.

Work in this field that pays

Fraud prevention employs analysts, chargeback specialists, and PCI assessors. Card networks, issuers, processors, and merchants hire for these roles. The work is salaried and carries no prison exposure.