Short answer
There is no lawful step-by-step method for selling CVV data on dark web sites. In the United States, a CVV is part of a cardholder's sensitive authentication data, and offering that data for sale without the cardholder's permission is trafficking in unauthorized access devices under 18 U.S.C. 1029. Each stage of the operation, from obtaining the numbers to advertising them to collecting payment, is a separate federal charge. This page explains the law and the penalties rather than providing instructions.
What the terms mean
The CVV is the three or four digit verification value printed on a payment card. It exists so a merchant can confirm that the person using the card has the card in hand. Card networks group the CVV, the full primary account number, the expiration date, and the cardholder name as sensitive authentication data. Merchants that accept cards are required to protect that data under the PCI Data Security Standard. Anyone who is not the cardholder or an authorized processor has no legal basis to hold it, let alone market it.
Is Selling CVV on the Dark Web Safe? No, and Here's Why
Why every stage of that business is a crime
- Obtaining card numbers from a breached merchant, a skimmer, or a phishing page is unauthorized access to a protected computer and to payment records.
- Copying or storing the data is prohibited for anyone outside the payment chain.
- Posting the data for sale, whether on a hidden marketplace or a chat channel, is the trafficking offense itself.
- Accepting cryptocurrency or any other payment for the data adds money laundering charges on top of the trafficking count.
- Working with others to run the operation creates a conspiracy charge that applies to every participant, including people who only move funds or host the site.
Federal penalties
Trafficking in unauthorized access devices carries up to 10 years in federal prison for a first offense. The maximum rises to 15 years when the offense involves a device issued by a financial institution or when the defendant has a prior conviction. Courts can also impose fines, order restitution to the issuing banks and cardholders, and order forfeiture of equipment, accounts, and cryptocurrency tied to the scheme. State prosecutors bring parallel cases for identity theft and computer crimes.
Selling CVV Online via Darknet for Bitcoin: A Guide
How issuers and acquirers spot resold card data
Banks watch for the pattern that resold numbers create: many small test authorizations on one card, then a burst of purchases in unrelated locations. Machine learning models at card networks score these events and route them to fraud analysts. Merchants that see a spike in declines on a single card range submit alerts to their acquirer. When a marketplace is taken down, investigators recover transaction logs, wallet addresses, and account metadata that link sellers to the operation.
guide to selling cvv online dark web
Lawful routes for handling card data
- Become a registered merchant with a sponsoring bank and an acquirer.
- Use tokenization or a hosted payment page so your systems never store the full account number.
- Keep your PCI DSS attestation current and limit staff access to cardholder data.
- Route any request for card data to your payment processor's compliance team.
If your own card number is being offered for sale
- Freeze the card in your bank or issuer app.
- Call the number on the back of the card and ask for a new account number, not just a new plastic.
- Report the theft at IdentityTheft.gov and keep the recovery plan it generates.
- File a report with your local police department and with the FBI Internet Crime Complaint Center if the theft came from an online breach.
- Place a freeze on your credit files with all three credit bureaus and review your statements for small test charges.