Selling CVV data for cash is illegal in the United States. A CVV is part of a payment card record, and trading it without the cardholder's permission is card fraud under 18 U.S.C. § 1029. No license, loophole, or offshore server makes that sale legal.
The sections below cover the statute, the penalties sellers receive, where card data comes from, and the legal work that pays for the same skills.
What does US law say about selling card data?
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A card number, expiry date, and CVV count as access devices. Selling, transferring, or holding them with intent to defraud is a federal crime.
The statute allows up to 10 years in prison for a first offense, and up to 15 or 20 years for aggravated conduct. Fines can reach twice the gross gain or gross loss from the scheme.
Two more charges often stack on top:
- Wire fraud under 18 U.S.C. § 1343, up to 20 years.
- Aggravated identity theft under 18 U.S.C. § 1028A, a mandatory 2 years that runs after the main sentence.
State laws add their own counts. Most states treat card data trafficking as a felony with prison time and restitution attached.
Is there such a thing as a legal CVV market?
No. A CVV is generated by the card issuer and tied to one account. Only the issuer and the cardholder have a right to it.
Payment networks bar merchants from storing the CVV after a transaction authorizes. PCI DSS Requirement 3.2 states that sensitive authentication data must not be kept post-authorization. A file full of fresh fullz therefore cannot come from any compliant business.
Every listing that claims a legal sale is one of three things: a stolen data dump, a scam that keeps your payment, or a law enforcement operation. None of them ends with the seller keeping money.
Where does stolen card data come from?
Most card data leaks from three sources: skimmers on gas pumps and ATMs, breaches at retailers, and phishing pages that copy checkout forms.
Some of it comes from insiders who photograph cards at restaurants and hotels. The rest comes from malware that reads a victim's own device.
Stolen records move through private chat groups first, then to open marketplaces, then to resellers who package them as fresh fullz.
How do CVV shops get shut down?
- Banks and card networks flag the accounts used to cash out.
- The FBI and Secret Service buy from the site, trace the crypto, and identify the operator.
- Prosecutors charge the site owner and, in some cases, the resellers.
- Domains get seized and replaced with a notice.
Marketplace takedowns follow this pattern. When UniCC, a large carding site, was seized in 2022, arrests and asset seizures followed across several countries. Sellers on those sites are not anonymous in practice.
What happens to people who sell CVV for cash?
Sentences turn on the number of cards, the total loss, and whether the person ran the site or resold a small batch. Resellers with a handful of cards still face felony convictions.
Consequences beyond prison:
- Restitution to banks and cardholders.
- Forfeiture of cash, cars, and crypto.
- Loss of the ability to hold a job that touches payments or finance.
A federal conviction also blocks many professional licenses and shows up on every background check for life.
Can you work with card data and stay legal?
Yes. Payment security is a hiring field, and employers value people who understand how carding works.
- Fraud analyst at a bank or fintech.
- Payment security engineer.
- PCI DSS auditor or compliance specialist.
- Chargeback and dispute analyst.
- Threat intelligence researcher at a card network.
These roles pay salaries and carry no prison risk. Several of them hire people who learned the technical side from the defensive angle.
How do you report a CVV seller?
Send the site or listing to the FBI's Internet Crime Complaint Center at ic3.gov. You can also file with the FTC at ReportFraud.ftc.gov and call the card issuer's fraud line.
Give the agents what you have: the domain, the payment method, screenshots, and any wallet address. Do not send money to test the site.
FAQ
Is selling CVV legal in any country?
No major country allows it. The UK, EU, Canada, and Australia all criminalize card data trafficking. Some places have weaker enforcement, but weak enforcement is not legality.
Are test CVV or filler CVV files legal?
No. Test numbers exist for developers, and they come from the card networks with no real account behind them. Files sold as test data often hold stolen cards.
What is the penalty for one CVV sale?
Federal sentencing looks at loss amount and the number of victims. A single card can still produce a felony charge, probation, and restitution. Repeat conduct pushes the range higher.
Where can I learn about payment security?
Start with the PCI Security Standards Council's public documents and the card networks' fraud prevention guides. Free courses on payment systems run from several universities and trade groups.
Bottom line
There is no legal way to sell CVV data for cash. The activity is card fraud, and US prosecutors treat it as a federal felony with prison, fines, and forfeiture. If you want to work with payment data, the fraud prevention side hires and pays.