Where Do Carders Sell Dumps? Underground Card Market Guide

Where do carders sell dumps? The short answer

Stolen payment card data changes hands in three broad places: invite-only carding forums, encrypted chat platforms like Telegram and Discord, and Tor-based marketplaces that range from hand-run shops to automated stores. None of them are public storefronts. Access usually requires an invite, a vouch from an existing member, or a deposit held in escrow. That gatekeeping is the first thing worth understanding, because it is also where most people lose money.

The label matters too. A "dump" is typically Track 1 or Track 2 data pulled off a card's magnetic stripe. "CVV" or "fullz" listings bundle the card number, expiration, and security code with personal details. Different products, different prices, different buyers.

The three main venues

Closed carding forums

These are the old guard. Registration is closed or gated, and sellers build reputation through buyer feedback, escrow services, and vouches from accounts with history. The forums host everything: dumps, fullz, bank logins, cashout services, and tutorials. Law enforcement watches them closely, and several of the biggest names have been seized or breached by researchers over the years.

Telegram and Discord channels

Chat apps took over a lot of the volume because they are fast, mobile, and simple to spin up. A channel gets created, a few hundred members join, cards get posted as images with prices attached, and the whole thing disappears a week later. There is almost no accountability built in. When a channel vanishes with prepaid funds, members have no recourse at all.

Tor marketplaces and automated shops

Dark web shops sell dumps through a web interface, often with search filters by BIN, country, and card type. Some are automated, some are run by a single person. The larger ones have gone offline through seizures or exit scams, and the survivors tend to be smaller and shorter-lived. Uptime is measured in months, not years.

What is actually being sold

A magstripe dump contains the track data needed to encode a physical card. That data was usually captured by a skimmer at a gas pump or ATM, or pulled from a merchant breach. A CVV listing, by contrast, is meant for online purchases and includes the three-digit code. Pricing reflects freshness, the issuing bank's BIN, the country, and whether the card has been validated with a small test charge.

Why the market is a bad deal even on its own terms

• Exit scams are routine. Sellers collect payment and close the shop.
• Many listings are recycled or already dead. Cards get canceled the moment a fraud alert fires.
• Escrow is often run by the same people selling the data.
• Some shops are honeypots or run by researchers and law enforcement.
• Buyers who connect from an unprotected device expose themselves to malware and extortion.

The uncomfortable truth is that a large share of the customers in these venues are being defrauded by the vendors. The business model depends on it.

Why magstripe dumps are worth less than they used to be

EMV chip adoption in the US gutted a lot of the classic magstripe cashout play. Chips generate a unique cryptogram per transaction, so cloned stripe data fails at most terminals in chip-enabled countries. What is left is a mix of online card-not-present fraud, fallback transactions at older terminals, and cards issued by banks that lagged on deployment. Tokenization and real-time fraud scoring have squeezed the margins further.

The legal reality

Buying, selling, or possessing stolen card data is a federal crime in the US under 18 U.S.C. § 1029, which covers access devices and carries fines and prison time that scale with the number of cards and the dollar amount involved. Prosecutors have charged buyers, not just sellers. A single undercover transaction is enough to build a case.

If your own card was exposed

1. Check your statements for small test charges, usually under two dollars.
2. Freeze or replace the card through your bank's app.
3. Pull your credit reports and watch for new accounts.
4. Report fraud to the FTC and, if you are in the US, to the FBI's IC3.

For anyone on the other side of the question, the practical takeaway is simple. The venues exist, they are heavily monitored, and the people running them are usually scamming the people using them. That is the whole business model in one sentence.