Selling CVV data for cash is a federal crime in the United States, and no legal version of that business exists. A CVV is security data tied to someone else's payment card, so trading it for money counts as access device fraud and wire fraud.
How to Sell CVV for Cash: A Comprehensive Guide
That answer holds in every US state. The sections below explain what the terms mean, which laws apply, what penalties look like, and how people earn money from card payments without breaking the law.
What Is a CVV and What Does "Fullz" Mean?
A CVV (card verification value) is the short code printed on a payment card. Visa, Mastercard, and Discover use a three-digit code on the back, while American Express uses four digits on the front.
- CVV2 / CVC2: the code requested for online and phone purchases.
- Fullz: slang for a bundle of stolen data, often a name, address, Social Security number, date of birth, card number, expiration date, and CVV.
- Dumps: card data copied from a magnetic stripe or chip.
None of these items belong to the person selling them. The cardholder owns the account, and the issuing bank owns the payment credentials.
Is It Legal to Sell CVV for Cash in Any Situation?
No. There is no license, permit, or registration that lets a person sell another person's card data. Four facts close the loopholes people try to use.
- The cardholder never gave consent.
- The data came from theft, skimming, phishing, or a breach.
- The buyer plans to make purchases or pull cash without authorization.
- Money moves through banks, which puts the deal in interstate commerce.
Some sellers claim they are just "reselling" data from a vendor. That claim adds a charge instead of building a defense, because courts treat each handoff as its own offense.
Which Federal Laws Cover CVV Sales?
Prosecutors have several tools, and they often use more than one in the same case.
- 18 U.S.C. 1029 (access device fraud): covers producing, selling, and trafficking payment credentials. Sentences reach 10 years for many offenses and 15 years for larger trafficking operations.
- 18 U.S.C. 1343 (wire fraud): covers the online deals and the money transfer, with a maximum of 20 years per count.
- 18 U.S.C. 1028 (identity theft): applies when fullz include Social Security numbers or government IDs, and it can add a mandatory term.
- State laws: most states add their own theft, forgery, and computer crime charges on top.
Banks and card networks also sue. Civil judgments can follow a defendant for years after a prison term ends.
What Happens to People Who Get Caught?
Card networks watch for patterns, and investigators build cases long before an arrest. Common evidence includes chat logs, marketplace accounts, crypto trails, and seized devices.
One seizure can expose a whole operation. Blockchain analysis links wallets to exchanges, and exchanges keep identity records. Cooperating defendants then testify against the people above them.
Sentencing adds time for the number of victims, the dollar loss, and the use of stolen identities. Even a first offense can mean years in prison.
Which Ways to Earn Money From Card Payments Are Lawful?
Legitimate income from card payments comes from selling goods and services, not from selling data.
- Open a merchant account with a payment processor and accept cards from customers.
- Pay processing fees (often 1.5% to 3.5% per transaction) and keep the rest.
- Build an affiliate or referral business that earns commission on sales you drive.
- Work in fraud prevention, risk analysis, or payment operations for a company that handles cards.
You cannot sell your own CVV either. The code has no resale value, and any "buyer" who offers cash for it is running a scam or a sting.
What Should You Do If Someone Offers to Buy CVVs?
Treat the offer as a crime in progress. Do not reply, do not send data, and do not accept payment.
- Save the messages and the account names.
- Report to the FBI Internet Crime Complaint Center (IC3).
- File a report with the FTC at IdentityTheft.gov if personal data is involved.
- Tell your bank if a card of yours may be exposed.
How Cardholders and Merchants Cut Risk
- Tokenization: swaps the card number for a token that has no value if stolen.
- 3-D Secure: adds a bank check during checkout.
- Address Verification Service (AVS): matches the billing address to the card.
- PCI DSS rules: block merchants from storing CVV data after a transaction is authorized.
- Monitoring: flags odd purchase patterns before they turn into chargebacks.
FAQ
Can I sell my own CVV for cash?
No. A CVV is not property you can transfer. It exists to verify a payment on the account tied to it, and no legal market pays for it.
Is selling fullz legal if the data comes from a public source?
No. Public exposure does not create permission. Selling a Social Security number or a card credential remains a crime.
Is buying CVV data legal?
No. Buying is a separate offense from selling, and it carries its own penalties under the same statutes.
Are there legal marketplaces for card data?
There are legal marketplaces for payment services, such as processors and gateways that handle payments for your own customers. None of them sell CVVs.
In short, the phrase "sell CVV for cash legal" describes something that does not exist. The only lawful path to card revenue runs through a merchant account, a real product, and a processor that takes a cut.