No. Selling CVV, dumps, or fullz for bitcoin is a federal crime in the United States. Stolen card data counts as an "access device" under 18 U.S.C. § 1029, and trading it for cryptocurrency adds wire fraud and money laundering charges on top. There is no lawful version of a CVV shop.
Is selling CVV and fullz for bitcoin legal in the US?
Every step of the transaction is illegal: getting the card data, advertising it, selling it, and getting paid in bitcoin. The payment method does not change the charge. Bitcoin adds charges rather than hiding them.
Compare CVV Bitcoin Sellers: Review and Top Options
A fullz record is worse than a card number. When the file includes a Social Security number, date of birth, and billing address, prosecutors stack identity theft counts onto the access device counts.
Which laws make card data sales a crime?
Federal prosecutors use a set of statutes that overlap, so one sale can produce several counts. Here are the ones that appear in most carding cases.
How to Sell CVV and Exchange Bitcoin on a Secure Platform
18 U.S.C. § 1029: access device fraud
This is the core statute. It covers producing, selling, transferring, and possessing counterfeit or unauthorized access devices, and it covers trafficking in the data itself. A card number with its expiration date and CVV qualifies as an access device. Selling that data to a buyer in another state or country is the exact conduct the law names.
18 U.S.C. § 1028A: aggravated identity theft
Using another person's identity data during the offense carries a mandatory two-year prison term. That sentence must run on top of, and separate from, the sentence for the main charge. A judge has no discretion to fold the two together.
Wire fraud and money laundering
Every forum post, encrypted message, and bitcoin transfer crossing state or national lines supports a wire fraud count under 18 U.S.C. § 1343. Moving the proceeds through wallets and exchanges to disguise the source supports a money laundering count under 18 U.S.C. § 1956. Conspiracy charges under 18 U.S.C. § 371 often follow, because shops need more than one person to run.
Does bitcoin make CVV sales anonymous?
No. Bitcoin sits on a public ledger that records every transfer forever. Investigators do not need a warrant to read it, and a single cluster of addresses can be tied back to a person through exchange records, IP logs, and timing.
US exchanges must verify customer identity under the Bank Secrecy Act and report suspicious activity. That means the moment coins touch a regulated exchange or a peer-to-peer marketplace with know-your-customer rules, a name attaches to the wallet trail.
Chain analysis firms sell tracing software to law enforcement and to banks. Payment processors run their own monitoring. A deleted forum thread and a closed wallet do not erase the record.
What penalties does a seller face?
- Prison: up to 10 years for access device offenses, up to 15 years in aggravated cases, plus a mandatory 2 years for aggravated identity theft.
- Fines: felony fines that can reach $250,000 for an individual, per count.
- Restitution: repayment to banks, merchants, and cardholders for losses tied to the data sold.
- Forfeiture: seizure of cryptocurrency, computers, phones, cars, and cash connected to the operation.
- Collateral results: a felony record, loss of professional licenses, immigration consequences for non-citizens, and supervised release after prison.
Sentences are driven by the number of victims and the dollar loss. A shop with hundreds of records produces an offense level that sends first-time offenders to prison for years, not months.
Who investigates carding, and how do cases get built?
The FBI, the US Secret Service, the US Postal Inspection Service, and IRS Criminal Investigation all work carding cases, usually through a US Attorney's Office. Banks, card networks, and fraud-prevention vendors send reports that start the file.
Cases often begin with one seized laptop or one undercover purchase. Agents then work backward through chat logs, wallet addresses, and shipping records to identify the seller. Cooperative witnesses and co-defendants supply the rest.
Federal prosecutors have years, not weeks, to bring charges, so a case can surface long after the seller stopped. Old forum handles stay in evidence files.
Is any use of card data lawful?
Yes, but only with authorization from the cardholder, the issuer, or the merchant that owns the account data. Payment processors, fraud analysts, and security researchers handle card data every day under written contracts and network rules.
The dividing line is consent and authorization, not the format of the file. A fullz record sold on a forum has neither.
FAQ
Is buying CVV data also a crime?
Yes. Possessing unauthorized access devices with intent to use them is a federal offense, and the buyer commits the same underlying fraud. Buying is not a lesser charge than selling.
Can a seller claim they only shared information?
No. Courts treat the data as the instrument of the crime, and the sale is the criminal act. Calling a shop a research forum or a data service does not change how the statute applies.
Does hosting outside the US stop a prosecution?
Not by itself. The US charges non-citizens who never set foot in the country when victims or servers are here. Extradition depends on the country, so some defendants avoid arrest by staying in a state that refuses to hand them over. That is a limit on enforcement, not a legal defense.
Do the bitcoin buyers ever get caught?
Often yes. Buyers leave more traces than sellers because they test cards and receive shipped goods. Those shipments and test charges create records that tie back to a real person.
Bottom line
Selling CVV, dumps, or fullz for bitcoin is illegal in the United States and in most countries that cooperate with US investigations. Bitcoin payments create a permanent ledger instead of anonymity, and the penalties include prison, fines, restitution, and forfeiture. Legitimate work with card data requires documented authorization from the cardholder or issuer.
If you have been contacted about card data sales or crypto payments tied to them, talk to a licensed criminal defense attorney in your state before you respond to anyone.