Short answer

A "sell CVV online website" is a storefront for stolen payment card data. The CVV is the 3-digit code on the back of a Visa or Mastercard, or the 4-digit code on the front of an American Express card. The code confirms that the physical card is in hand. Sellers of CVV data do not own the cards. They sell numbers taken from data breaches, skimmers, and phishing pages. Buying or selling that data is a federal crime in the United States.

What a CVV does

Banks print a card verification value on each card. Merchants ask for it in card-not-present transactions, such as phone orders and web checkout. The code is not stored in the magnetic stripe and it is not printed on receipts. PCI DSS Requirement 3.2 bars merchants from storing CVV data after a transaction is authorized. That rule exists because the code alone can push a stolen card number through an online checkout.

How the market operates

Card data is traded on closed forums, invite-only shops, and chat groups. A listing carries a card number, expiration date, cardholder name, and the CVV. Prices vary by card type and by the amount of data included. Full profiles that carry billing address, Social Security number, and bank login sell for more than a bare card number. Sellers call the trade "carding."

Sources of the data include:

• Point-of-sale skimmers at gas pumps and registers
• Phishing pages that copy a bank login screen
• Merchant database breaches
• Malware on a cardholder device

The law

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A credit card account number counts as an access device. The statute reaches anyone who traffics in, sells, or uses such data without authorization. Penalties run up to 10 years in prison and fines under 18 U.S.C. § 3571. Related charges include wire fraud under 18 U.S.C. § 1343 and aggravated identity theft under 18 U.S.C. § 1028A, which adds a 2-year mandatory term.

State laws cover the same conduct. A conviction can also bring restitution to banks and cardholders.

Legal use of card data

No legal business buys CVV data from a third party. Payment processors handle card data under contracts and PCI DSS controls. Tokenization replaces the card number with a token so a merchant never holds the CVV. A merchant that needs card data gets it from the cardholder at the point of sale, not from a broker.

Risk to buyers

Most card data sold on these sites is stale or already flagged. Banks block the first charge, and the buyer loses the payment to the seller. Some listings come from law enforcement operations. Users who pay in crypto leave a ledger trail. Card networks and issuers share fraud signals, so one flagged card can burn a whole set.

If your card data is exposed

• Call the issuer and ask for a new card number
• Check statements for small test charges
• Place a free credit freeze with Equifax, Experian, and TransUnion
• Report the fraud at IdentityTheft.gov and to the FBI Internet Crime Complaint Center

Bottom line

A site that sells CVV data is a criminal operation, not a retailer. The United States treats the sale and purchase of card verification values as a felony. Cardholders who find unauthorized charges should contact the issuer and file a report with the FTC or IC3.