There is no legal guide for selling CVV data

Selling card verification values taken from payment cards you do not own is a federal crime in the United States. There is no licensed marketplace, no compliant payment processor, and no invoicing method for stolen card data. Listings that use tags like "v10" appear on criminal forums. Those forums are also where buyers and sellers cheat each other, and where investigators collect evidence.

How to Sell CVV V9: A Comprehensive Guide

What a CVV is

A card verification value is the 3-digit code printed on the back of most Visa, Mastercard, and Discover cards. On American Express cards it is a 4-digit code on the front. Issuers generate the code so a merchant can confirm the card is in hand. Under 18 U.S.C. 1029, a card number, code, or account identifier is an "access device."

how to sell cvv v9

Federal law and penalties

18 U.S.C. 1029 covers fraud and related activity with access devices. Trafficking in unauthorized access devices, which includes selling or transferring them, carries a statutory maximum of 10 years in prison for a basic offense. Aggravating factors raise the maximum. A scheme involving 10 or more devices, or losses of $1,000 or more in a 12 month period, can reach 20 years. Courts may add fines, restitution, and supervised release.

How to Sell CVV V7: A Comprehensive Guide

Prosecutors also charge 18 U.S.C. 1028 for identity documents and 18 U.S.C. 1343 for wire fraud when card data moves across state lines or the internet.

related article

Enforcement in practice

The Department of Justice prosecutes carding cases through U.S. Attorney offices and the Criminal Division. The FBI runs the Internet Crime Complaint Center, which logs credit card fraud complaints from the public and from banks. The FTC publishes identity theft data and takes complaints at its consumer site. Card networks and acquiring banks monitor transaction patterns and close merchant accounts tied to fraud.

Legal ways to handle card data

Businesses that accept cards need the card number and the CVV at the moment of authorization only. PCI DSS rules forbid storing the CVV after authorization. Compliant processors tokenize the card number, which replaces it with a reference value. The merchant then charges the token instead of the card. This is the only legal path for handling CVV data.

If you find CVV data in your possession

Do not sell it and do not use it. Report it to the card issuer and to the FTC or the FBI Internet Crime Complaint Center. If a data set was offered to you for purchase, that offer is itself evidence of a crime.