Fullz and CVV Selling Guide: Fraud, Law, and Data Protection

There is no legitimate guide to selling fullz or CVV data, because buying and selling that data is payment card fraud. "Fullz" means a bundled record of a person's card and identity details, and "CVV" is the three or four digit security code printed on a card. Neither can be sold lawfully by anyone who is not the cardholder or an authorized processor, and a guide that explains how to do it would be instructions for a federal crime. What follows is the accurate version of the topic: what the terms mean, why the market around them is built on scams, and what the law does to people who participate.

related article

Where the terms come from

Fraud forums use "fullz" to describe a package that pairs card data with a name, address, date of birth, and sometimes a Social Security number. The word is marketing language, not a technical term used by banks or payment networks. A CVV exists so that a merchant can confirm the physical card is present. When someone sells a CVV separately from the card, the only thing being sold is the ability to impersonate the cardholder in a card-not-present transaction.

related article

Why the "vendor" side of this market is mostly fraud against its own customers

Card data markets are run by criminals, and participants cheat each other as a matter of routine. Buyers report receiving stale records, reused numbers that were already blocked, or data fabricated from breach lists that never worked. Sellers report chargebacks and exit scams. There is no dispute process, no regulator, and no way to enforce a deal, because asking a court to enforce a contract for stolen card numbers is not a realistic option. People who pay for fullz typically lose the money and gain a record of having sent funds to a criminal operation.

read more

Legal exposure in the United States

Handling this data is charged as a serious felony, and the statutes apply to buyers, sellers, and intermediaries alike.

• 18 U.S.C. 1029 covers fraud and related activity in connection with access devices, which includes card numbers, account numbers, and CVVs. Trafficking in them is a standalone offense.
• 18 U.S.C. 1028 covers identity documents and authentication features, and it reaches the identity bundles that fullz are built from.
• 18 U.S.C. 1343 covers wire fraud, which is how most online sales of this data are charged.
• 18 U.S.C. 1028A adds a mandatory two-year consecutive sentence for aggravated identity theft in covered cases.

Sentences in these cases are measured in years, and restitution orders follow the defendant after release. Possession of large volumes of card data is itself evidence that prosecutors use to establish intent.

If your own card or identity data was exposed

Act on the assumption that anything leaked will be used. Order matters.

1. Contact the card issuer and ask for the card to be closed and reissued. Do not wait for a fraudulent charge to appear.
2. Place a free fraud alert or a credit freeze with each of the three nationwide credit bureaus.
3. Pull your credit reports and look for accounts and inquiries you do not recognize.
4. Change passwords on banking, email, and any account that used the exposed card, and turn on two-factor authentication.
5. File an identity theft report at IdentityTheft.gov, which produces a recovery plan and an official record you can give to creditors.
6. File a report with the FBI Internet Crime Complaint Center if the exposure came from an online transaction or breach.
7. Keep a written log of every call, date, and reference number until the matter is closed.

Reducing future exposure

• Use virtual or single-use card numbers for online merchants when your issuer offers them.
• Never send card details by email, text, or chat. Legitimate processors do not ask for that.
• Check that a checkout page is served over HTTPS and belongs to the merchant you intend to pay.
• Keep your card's CVV covered in public, and do not store card photos on your phone.
• Review statements line by line. Small test charges often precede larger ones.