A CVV or CVC is the 3-digit code on the back of most payment cards, or the 4-digit code on the front of an American Express card. That code plus the card number is access device data. Selling it, buying it, or trading it for Bitcoin is card fraud. No legal market exists for it.
US law
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A card number with its CVV falls under that definition. Trafficking in access devices carries up to 10 years for a first offense and up to 15 years for a second. Fines and restitution follow a conviction. Wire fraud charges under 18 U.S.C. § 1343 can stack on top when payment moves through Bitcoin or another network.
What "honest seller" posts mean
Posts on Reddit, Telegram, or carding forums that promise verified CVV lots and escrow have no enforcement mechanism behind them. Reddit bans these communities when it finds them. A buyer who sends Bitcoin first has no chargeback path and no identity for the seller. A seller who delivers data cannot prove the data works. A buyer who receives it cannot test it without committing a second crime.
Reported loss totals
The FTC collects identity theft and card fraud reports through IdentityTheft.gov. The FBI Internet Crime Complaint Center publishes credit card fraud complaint totals each year. Reported losses run into the billions of dollars. Those figures come from victims who filed reports.
How to Sell CVV Online with Bitcoin Safely
If your card data leaks
- Freeze the card in the issuer app.
- Request a new card number and a new CVV.
- File a report at IdentityTheft.gov.
- File a complaint at IC3.gov if money moved.
Unknown: the exact split between card-present and card-not-present fraud in the most recent IC3 totals. The annual report lists broad categories, not that breakdown.