There is no legitimate place to sell CVV on the dark web. Selling, buying, or trading payment card data is a federal crime in the United States and a crime in essentially every other country, and every marketplace that advertises itself as a "legit" CVV shop is either a scam, a carding forum run by criminals, or a law enforcement operation. The search phrase itself describes something that does not exist.
Where Do People Trade CVV Data on the Dark Web? Why It Is Illegal
Why no legitimate CVV marketplace can exist
A CVV is security data tied to someone else's payment card. It only has value to a criminal because it lets someone move money that does not belong to them. That means there is no lawful supply chain, no licensed dealer, and no consumer protection framework that could make such a market legitimate. Any platform hosting CVV sales is hosting evidence of stolen-property trafficking.
Where to Find Offers for CVV on Tor
- Card data can only be "sold" if it was stolen, skimmed, phished, or leaked from a breached merchant.
- Payment networks and issuers void transactions flagged as card-not-present fraud.
- No regulator, bank, or payment processor authorizes resale of card credentials.
What "legit CVV" listings actually are
Sellers who market themselves as honest, escrow-backed, or "verified" are running one of a few well-worn plays:
Where to Sell CVV on the Dark Web Safely
- Advance-fee scams. The buyer pays for a "test" card or an escrow deposit and receives nothing, or receives data that was already burned.
- Carding forum bait. Listings harvest buyer identities, crypto wallets, and contact details for later extortion.
- Law enforcement operations. Investigators run or infiltrate storefronts to identify buyers and sellers, and undercover purchases are used as evidence.
- Recycled breach dumps. The same card numbers are resold to dozens of buyers until issuers block them.
The word "legit" in these listings is a marketing signal aimed at nervous first-time buyers, not a description of the business.
Legal exposure in the US
Trafficking in access devices is covered by federal criminal statute, and prosecutions routinely involve people who only handled a handful of cards. Depending on the facts, charges can include access device fraud, identity theft, computer fraud, and money laundering conspiracy. Wire and mail fraud charges often follow because the transactions cross state lines and payment rails. Sentences commonly include prison time, supervised release, restitution, and forfeiture of computers, phones, and crypto assets.
State prosecutors also file their own identity theft and fraud charges, so a single case can proceed on two tracks at once.
How sellers get identified
Dark web markets are not anonymous in practice. Investigators trace cryptocurrency through blockchain analysis, seize servers, and correlate forum handles with email accounts, shipping addresses, and login metadata. Buyers who never sold a single card have been charged after a marketplace takedown because their account history was recovered intact.
If someone offers you card data
- Do not respond, pay, or "test" anything. Any payment is itself evidence.
- Preserve the message and report it to the FBI's Internet Crime Complaint Center.
- Report the solicitation to the FTC, which tracks card-fraud patterns.
- If the offer came through a workplace, notify your security team immediately.
Protecting your own card data
The same channels that move stolen CVVs target ordinary cardholders. Use virtual card numbers for online merchants when your issuer offers them, enable transaction alerts, freeze your credit when you are not applying for credit, and treat unsolicited messages asking you to "verify" card details as fraud until proven otherwise. If a card number was exposed, request a replacement rather than waiting for a fraudulent charge to appear.
The bottom line
People searching for where to sell CVV on the dark web are looking for a market that cannot lawfully exist. The realistic outcomes are losing money to a scam, having your identity harvested, or being named in a federal indictment. There is no legitimate version of this transaction to find.