Short answer

There is no legitimate way to sell a CVV online. A CVV is a card security code, not a product. Sites that advertise "legit CVV" sales fall into three groups: fraud operations that sell stolen card data, scams that take payment and deliver nothing, and law-enforcement channels. Selling, buying, or brokering a CVV in the US is a federal crime under 18 U.S.C. § 1029.

Trusted CVV Online Selling Platform Guide

What a CVV is

A CVV is a 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The issuing bank generates the code and ties it to one account. The cardholder cannot sell it. No third party can buy it. The code exists to prove the physical card is present during a card-not-present transaction.

Legitimate CVV Online Sale Opportunity

What the law says

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A card account number paired with its CVV is an access device. Section 1029(a)(3) makes it a crime to traffic in one or more access devices with intent to defraud. Penalties reach 10 years in prison for a basic offense. Aggravated offenses, including cases that involve multiple devices or at least $1,000 in value in a one-year period, reach 15 years. Courts add restitution and forfeiture on top.

read more

Related charges stack. Prosecutors add wire fraud under 18 U.S.C. § 1343, identity theft under § 1028A, and state identity-theft counts. All 50 states have their own statutes.

Trusted CVV Online Selling Option

How "CVV shops" operate

• Listings show prices and inventory that no buyer can verify before payment.
• Payment runs through crypto. Delivery is a text file or a bot reply.
• Most sites close within weeks and reopen under a new domain.
• Review pages and escrow services are often run by the same group as the shop.
• Data sold is stale, invalid, or already blocked by the issuer.
• Some operations are run by police. Purchases become evidence.

Card networks and banks do not authorize any of this. A shop with a polished design and a trust score is still a shop selling stolen data.

Who handles CVV data under the law

Issuing banks, card networks, payment processors, and merchants handle card security codes. PCI DSS v4.0 bars storage of the CVV after authorization. Staff with access work under contract, background checks, and audit. None of these organizations sells card data, and none of them lists inventory on a public forum.

If you were targeted

Call the number on the back of the card. Ask for a replacement card and a new account number. File a report with the FTC and with the FBI Internet Crime Complaint Center. Keep the card statement and any correspondence.

Legitimate work with card data

Roles exist in payment processing, fraud analytics, chargeback operations, and PCI auditing. These positions require a background check and a signed data-handling agreement. They pay a salary. They do not involve selling codes.