You cannot sell CVV data legally. A CVV is a security credential tied to a payment card, and selling, trading, or transferring it to anyone who is not the cardholder or an authorized processor is a federal crime under 18 U.S.C. § 1029. There is no license, registration, or business structure that makes trafficking in card verification values lawful in the United States.
Why is selling CVV data illegal?
Federal law treats card numbers, CVV codes, magnetic stripe data, and PINs as "access devices." Anyone who sells, transfers, or possesses them with intent to defraud commits access device fraud. The statute covers the seller, the broker, and the buyer equally.
How to Sell CVV: A Review of Top Options
Card network rules reinforce the law. Visa and Mastercard prohibit merchants and processors from storing CVV2 or full track data after authorization. PCI DSS Requirement 3.2 makes retention of sensitive authentication data a compliance violation even for legitimate businesses.
What exactly does the law prohibit?
- Selling or transferring a card number or CVV you do not own.
- Purchasing card data for any purpose other than authorized processing.
- Possessing "fullz" bundles that combine card data with identity information.
- Operating a marketplace, forum, or bot shop that moves card data.
- Storing CVV codes after a transaction is authorized.
What are the penalties for selling CVVs?
A first offense under § 1029 carries up to 10 years in federal prison, and trafficking offenses carry up to 15 years. Courts add restitution, supervised release, and forfeiture of proceeds and equipment. Sentences stack when identity theft or money laundering charges are added.
Prosecutors do not need a completed sale to charge you. An offer to sell, an advertisement, or possession with intent is enough. Undercover purchases and platform subpoenas routinely supply the evidence.
Is buying a CVV legal if I only use it once?
No. Intent to defraud is the element that matters, not the number of uses or the dollar amount. Using a single stolen card number is still access device fraud, and the cardholder's bank will dispute the charge.
Can I sell my own card number or CVV?
Selling your own card details does not create a legal product. The buyer is acquiring a credential to commit fraud, and you become a participant. Issuers also void cardholder protections when credentials are knowingly shared.
What lawful businesses look like this but are legal?
Several legitimate industries handle card data under contract and compliance. Each requires authorization from the cardholder, the issuer, or the card networks.
- Payment processing and merchant acquiring. Register as an ISO or payment facilitator with the card brands and sponsor banks. You earn fees on transactions, not on the data itself.
- Tokenization and vaulting services. Store network tokens instead of raw card numbers. Tokens are useless to a thief, which is why this model passes compliance review.
- Fraud prevention and threat intelligence. Sell detection software, risk scoring, or takedown services to merchants and issuers. Never resell the underlying card records.
- Card portfolio servicing. Work as a contracted servicer for an issuing bank under a written agreement and PCI DSS assessment.
How do I start a compliant card-data business?
Begin with a PCI DSS assessment and a sponsor bank relationship before you touch any card data. Define in writing which data elements you store, for how long, and who can access them. Exclude CVV and track data entirely, because no business case justifies retaining them.
Then register with the card brands, carry cyber liability insurance, and document your data retention policy. Compliance audits are routine, and gaps are the most common cause of contract termination.
What should you do if someone offers to sell you CVVs?
Decline and report it. In the U.S., file a complaint with the FBI's Internet Crime Complaint Center or the FTC at ReportFraud.ftc.gov. If you received unsolicited card data, delete it and notify your acquirer or compliance officer.