A CVV dump is a record built around payment card data, usually the card number, expiration date, and the card verification value, while a fullz is a broader identity record that wraps that card data in the cardholder's personal details. For online purchase security, the fullz is the more dangerous of the two because it can pass both card verification and identity checks, where a dump normally fails the second test.
What Is a CVV Dump? Card Security Code Risks Explained
CVV Dump vs Fullz at a Glance
- Core content: a dump centers on card credentials; a fullz adds name, address, phone, date of birth, and sometimes account logins.
- What it defeats: a dump targets the payment step; a fullz targets the whole account and identity layer.
- Typical use in fraud: dumps feed card-not-present charges, fullz feed account takeover and new-account fraud.
- Damage window: dumps usually die when the card is reissued; fullz damage can outlast the card by months.
- Defensive priority: fullz are the harder problem for merchants and issuers to contain.
What a CVV Dump Contains
The term comes from the card verification value printed on the card or generated for a digital wallet. In the fraud economy, a dump is a compact bundle: long card number, expiry, CVV, and often the cardholder name and billing ZIP. That is enough to attempt a card-not-present transaction on a site that asks only for card fields.
This is why CVV data is treated as sensitive under PCI DSS. The standard forbids storing the verification code after authorization, precisely because a leaked code plus a card number is close to a complete checkout payload.
What a Fullz Contains
A fullz is a full identity profile, not just a payment record. Alongside card or bank details, it commonly carries the person's legal name, home address, email, phone number, date of birth, and sometimes answers to common verification questions or credentials for existing accounts.
That extra layer is what makes fullz valuable. Fraud teams use them to open new accounts, reset passwords, redirect deliveries, and pass Know Your Customer checks that a bare card number cannot satisfy.
Why the Difference Matters at Online Checkout
Modern checkout stacks rarely rely on the CVV alone. Address verification, 3D Secure challenges, device fingerprinting, velocity rules, and behavioral scoring all sit between the cart and the authorization. A dump has to survive every one of those layers with nothing but card data, so it is caught early in most well-tuned systems.
A fullz arrives with the billing address, the phone number tied to the account, and the history a fraudster needs to answer a challenge question. Each verification step that stops a dump becomes a step a fullz can plausibly pass. The result is a higher approval rate, a longer time before detection, and a dispute that looks like a legitimate customer at first review.
Which Threat Should You Prioritize?
Start with fullz. If your fraud controls treat every risky order as a possible stolen card, you will catch dumps and miss identity-driven abuse. Build your primary defenses around identity consistency: does the person placing the order match the person on the account, the device, and the delivery address? Then layer card-level checks underneath for the simpler dump cases.
Option 1: Identity-First Controls for Merchants
- Require strong customer authentication on high-value or first-time orders.
- Compare billing address, shipping address, phone, and email against account history.
- Flag orders where a new device, a new address, and a new payment method appear together.
- Use step-up verification for password or email changes made shortly before a purchase.
- Review manual holds on orders that pass authorization but fail consistency checks.
Option 2: Card-Level Controls as a Second Layer
- Never store the CVV or CVC after authorization.
- Tokenize card numbers so a breach yields useless references instead of live credentials.
- Run address verification and CVV checks on every card-not-present transaction.
- Set velocity limits per card, per device, and per IP range.
- Share confirmed fraud patterns with your payment processor and acquirer.
Option 3: Shopper-Side Habits
- Turn on transaction alerts so an unexpected charge surfaces within minutes.
- Use virtual card numbers for unfamiliar merchants.
- Keep a separate email and password for shopping accounts.
- Freeze your credit or place a fraud alert if your identity details, not just your card, may be exposed.
- Report card fraud to your issuer right away and file a report if identity theft is involved.
Warning Signs Worth Acting On
Orders that ship to a new address on the same day the account email changed deserve a pause. So do purchases where the customer cannot recall details that appear in their own profile, or where a phone number and address belong to different people. On the consumer side, a card that works fine but an account that suddenly needs a password reset is the pattern that separates a dump incident from a fullz incident.
The Bottom Line
CVV dumps and fullz differ in scope, and that difference decides which defenses matter. A dump is a payment problem with a short shelf life. A fullz is an identity problem that can survive a card replacement. Treat identity verification as the primary control and card verification as the backup, and you cover the more damaging case first.