No legitimate website sells CVV numbers. The CVV is the three or four digit security code on a payment card, and it exists to prove the buyer holds the physical card. Any storefront advertising CVVs for a dollar or two is trading in stolen card data, which is a federal crime in the United States under 18 U.S.C. § 1029.
Why real card issuers and processors never sell CVV codes
Banks, card networks, and payment processors treat the CVV as an authentication secret, not a product. Merchants are barred from storing that code once a transaction finishes, so no lawful supply exists to resell. Search results promising cheap CVVs lead to fraud operations, not to any business with a license, a refund policy, or a support line.
- Card issuers generate CVVs for the cardholder alone.
- PCI rules forbid keeping the code after authorization.
- No bank, processor, or merchant holds a legal channel to sell it.
- Prices of $1 to $5 per card signal stolen data, not a discount.
What happens on sites that advertise cheap CVVs
The pattern repeats across these storefronts. A buyer pays in crypto, receives a list of numbers, and finds the codes fail at checkout or the account vanishes within days. Losses stay unrecoverable because the payment method has no chargeback path and the seller has no verified identity.
- Dead numbers pulled from an old breach dump.
- Crypto-only payment with no dispute process.
- Sites that close and reopen under a new domain name.
- Sting operations run by card networks, police, or security researchers.
Buyers leave a trail. Chat logs, wallet addresses, and forum posts become evidence in access device cases.
Legal exposure in the United States
18 U.S.C. § 1029 makes it a crime to traffic in, produce, or use access devices. A basic offense carries up to 10 years in prison, and the ceiling rises to 15 years when the case involves 15 or more devices or $1,000 in value within a year. Individual fines can reach $250,000, and wire fraud or identity theft charges often stack on top.
Attempt counts too. Paying for card data, even when the numbers never work, can support a charge of attempted trafficking or conspiracy. A conviction also blocks many jobs, loans, and professional licenses.
Red flags of a card data scam
- Payment accepted only in cryptocurrency.
- No company name, address, or phone number on the site.
- Claims of "fresh" or "100% valid" numbers with no way to test them.
- Vouches posted by accounts created days earlier.
- Pressure to buy in bulk before a price increase.
Safer ways to handle card data
If the goal is to charge customers online, work with a processor that provides hosted payment fields and tokenization. If the goal is to protect your own card, ask your bank for virtual card numbers for online shopping. Both routes keep the CVV out of your records and out of anyone else's.
If your card data is already exposed
- Call the issuer and request a new card number, even if the card still works.
- Review statements going back several months for small test charges.
- Report identity theft through the FTC's consumer reporting site.
- File a complaint with the FBI's Internet Crime Complaint Center.
- Place a free credit freeze with each of the three major bureaus.
Common questions
Is there a real market price for stolen CVVs?
Quoted prices vary and carry no meaning, because the data is stolen, fake, or both. No reliable market data exists, and price does not change the legal status of the transaction.
Can I buy a CVV for my own card?
You already have it. The code sits on the back of the card and appears in your bank's app or online account. If it is worn off or the card is damaged, the issuer replaces it at no cost.
Is buying a CVV illegal if I never use it?
In most cases yes. The statute covers trafficking and attempted trafficking, so intent plus payment can be enough for charges. The cardholder or issuer can also pursue a civil claim.
Why do these sites stay online?
Domains are cheap and disposable, and victims rarely report the theft because they were breaking the law themselves. That silence is exactly what the operators count on.