What does "CVV selling for payment" mean?

CVV selling for payment means trading a card's security code together with the card number, cardholder name, and expiry date so a buyer can charge that card online. The CVV is the 3-digit code on the back of most cards and the 4-digit code on the front of American Express cards. In the United States, selling that data is a federal crime under 18 U.S.C. § 1029, not a gray-area service.

read more

The phrase shows up in search results because people want to know how the trade works, what it costs, and what happens to buyers and sellers. The short answer: it is theft of a payment credential, and the penalties are real.

Where to Buy CVV for Financial Transactions

Why does the CVV matter more than the card number?

A card number is easy to guess or generate because the digits follow a known pattern. The CVV is printed on the physical card and is not written into the magnetic stripe, so it is harder to copy from a skimmer alone.

cvv selling for money

Banks treat a correct CVV as proof that the buyer holds the card in hand. That single field is what lets a stolen number pass a basic online check, which is why fraud rings target it.

more on this topic

Is buying or selling CVV data illegal in the US?

Yes. 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices, and payment card credentials count as access devices. Penalties can reach 10 to 15 years in prison plus fines tied to the value of the fraud.

State prosecutors add their own charges for identity theft and larceny. Card networks also ban merchants and processors that touch stolen data, and a conviction follows you into any job that handles money.

How do banks detect card-not-present fraud?

Issuers score every online transaction in real time. A few signals carry the most weight.

• Address verification (AVS) compares the billing ZIP you type to the bank's record.
• Velocity checks flag many purchases from one device, IP address, or card in a short window.
• Behavioral models compare the basket size, merchant type, and hour of the purchase to your normal pattern.
• 3-D Secure prompts you for a one-time code from your banking app before the charge clears.
• Device fingerprinting links the phone or browser to past fraud cases.

When two or more signals fire, the issuer declines the charge or holds it for a call. That is why most purchased card data fails after one or two attempts.

How has tokenization changed the market for card codes?

Card networks now replace the real number with a token for online merchants, phone wallets, and subscriptions. The token works at one merchant or one device and carries no printed CVV.

Stolen CVVs still get used at small merchants that have not adopted tokenization or 3-D Secure. The pool of usable targets shrinks each year as more checkout pages move to token-based rails.

How can you protect your own card data?

Most card-not-present fraud starts with a leak you can limit.

• Use a virtual card number for subscriptions and one-off sites.
• Turn on transaction alerts in your banking app so a charge over your set limit pings you.
• Skip saving card details in browsers and retailer accounts.
• Cover the CVV with a sticker if you keep cards in a bag or pocket.
• Read statements each week and look for small test charges near $1.

What should merchants do to block stolen CVVs?

Require AVS and CVV checks on every manual-entry order, and treat a mismatch as a decline rather than a warning. Add 3-D Secure for high-risk categories such as electronics, gift cards, and digital goods.

Set velocity limits per card, per email, and per shipping address. Log the device fingerprint and IP address so you can block repeat offenders. Follow PCI DSS rules for any card data you store, and store as little as possible.

Where do you report card fraud?

Call your card issuer first. They can freeze the account, reverse the charges, and send a new number, and federal law limits your liability for unauthorized use.

• FTC at IdentityTheft.gov, which builds a recovery plan and affidavit you can send to creditors.
• FBI Internet Crime Complaint Center at ic3.gov, which tracks payment fraud patterns.
• Your state attorney general's consumer protection office.
• The merchant's payment processor, if a business account was used to move the funds.

Frequently asked questions

Can you buy CVV data from a legitimate seller?

No. There is no licensed or regulated market for card security codes. Any seller offering them is trading stolen credentials, and a buyer commits a crime the moment the data changes hands.

Is a CVV the same as a PIN?

No. The CVV verifies the card for online and phone orders. A PIN authorizes ATM and debit transactions at a terminal. Banks never ask for your PIN over the phone or by email.

Does the bank refund card-not-present fraud?

In most cases, yes. US law caps your liability for unauthorized card charges when you report the loss within a reasonable time. Report fast, because delay is the one thing that can shift the cost to you.

What is the difference between a CVV, CVC, and CVV2?

They are the same idea under different brand names. Visa calls it CVV2, Mastercard uses CVC2, Discover uses CID, and American Express prints a 4-digit code on the front. Each one proves the buyer has the card.

The bottom line

Selling or buying CVV data is payment card fraud, and US federal law treats it as a serious offense with prison time attached. Banks catch most of it through AVS, velocity checks, and 3-D Secure before a charge clears.

If your own card is hit, call the issuer, then file with the FTC and the IC3. If you run a store, turn on every available verification tool and store as little card data as your processor allows.