Is selling CVV codes legal?

No. Selling a CVV code that belongs to someone else's payment card is a federal crime in the United States. The CVV is the 3 digit code on the back of most cards, or the 4 digit code on the front of American Express cards. It exists to prove the person using the card holds the physical card.

read more

A CVV on its own does not transfer money. It is an authentication value tied to a card account. When a person sells it to a buyer, the buyer uses it to authorize charges the cardholder did not make. That is card fraud, and the sale is the act that makes it possible.

more on this topic

What federal law covers this

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A payment card and its CVV are access devices under that statute. The law prohibits producing, selling, transferring, or possessing card account numbers with intent to defraud. Penalties reach 15 years in prison for certain counts and fines that can exceed $250,000. Aggravated cases under § 1029(b) carry a 20 year maximum.

related article

Other charges can stack on top of that:

how to sell cvv v6

• Wire fraud, 18 U.S.C. § 1343
• Identity theft, 18 U.S.C. § 1028A, which adds a mandatory 2 year term
• Money laundering, 18 U.S.C. § 1956, if proceeds move through accounts
• Conspiracy, 18 U.S.C. § 371

What happens to sellers in practice

Card marketplaces are monitored. Federal agents run undercover operations on carding forums and buy data to trace sellers. Payment processors and card networks flag bulk authorization attempts. A seller who uses cryptocurrency to collect payment leaves a ledger that investigators can follow through exchange records and subpoenas.

Sentencing in these cases depends on the number of cards, the total loss, and the number of victims. Courts have imposed multi year prison terms for operations involving a few thousand card records.

What to do instead

If the question is how to work with payment data in a legal context, the answer is to work with a licensed payment processor. Businesses that store or transmit card data must follow the PCI DSS standard. That covers encryption, tokenization, and access limits. Contact a payment processor or a qualified security assessor for that work.

If you have been a victim of card fraud, report it to the card issuer, then file a report with the FBI Internet Crime Complaint Center and the FTC at IdentityTheft.gov. Reports feed into the cases that lead to charges against sellers.

Reporting

There is no legal channel for selling CVV codes, so there is no legitimate guide to write. The only factual statement available is that the activity is a crime in the US and carries prison time.