There is no legal place to buy CVV fullz in the United States. Selling, buying, or holding stolen payment card data is a federal crime under 18 U.S.C. § 1029, and every site that advertises fullz for sale is a scam, a law enforcement sting, or both.
This guide covers what fullz are, why no legitimate marketplace exists, what the penalties look like, and how to keep your own card data out of those markets.
What Does "CVV Fullz" Mean?
A CVV is the three or four digit code printed on a payment card. "Fullz" is fraud slang for a complete stolen record: card number, expiration date, CVV, cardholder name, billing address, and often a Social Security number and date of birth.
Fraudsters want fullz because the extra fields help them pass address verification (AVS) checks at online checkouts. A bare card number fails many of those checks. A fullz record does not.
- CVV2 / CVC2: the code on the back of Visa and Mastercard cards.
- CID: the four digit code on the front of American Express cards.
- Fullz: card data plus identity data, sold as one file.
Is There a Legitimate Site That Sells CVV Fullz?
No. Card networks, banks, and payment processors ban the sale of stolen card data, and any processor caught handling those payments loses its ability to accept cards. That leaves underground forums and messaging apps as the only channels.
Nothing sold through those channels is verified. A buyer holds no receipt, no contract, and no legal remedy if the data turns out to be fake or the seller vanishes.
Why Do Buyers Get Cheated More Than Sellers?
- Generated numbers. Many sellers sell software generated numbers that decline at checkout.
- Burned data. Cards that were already reported stolen stop working within hours.
- Exit scams. The seller takes crypto and blocks the buyer.
- Blackmail. The seller keeps the buyer's contact and payment details for later demands.
- Malware. "Checker" tools and card generators ship with spyware.
The buyer cannot complain to a bank, a police department, or a consumer protection agency, because the transaction itself is a crime.
What Are the Penalties for Buying CVV Fullz?
Federal prosecutors charge card data cases under 18 U.S.C. § 1029, the access device fraud statute. Possession with intent to defraud carries up to 10 years in prison, and trafficking carries up to 15 years, with fines that reach $250,000 per count.
Other charges stack on top. Identity theft under 18 U.S.C. § 1028A adds a mandatory two year sentence, and wire fraud or money laundering charges can follow the payment side of the deal.
The Department of Justice has shut down carding marketplaces and charged their operators, including UniCC in 2022 and the operator of Try2Check in 2023. Account records from those sites became part of the evidence.
How Does Card Data End Up for Sale?
- Skimmers: hardware placed on gas pumps and ATMs that copies the magnetic stripe.
- Phishing: fake checkout pages that collect the number, CVV, and billing address.
- Merchant breaches: stolen card databases from retailers and service providers.
- Magecart attacks: malicious scripts injected into real checkout pages.
- Credential stuffing: reused passwords that unlock stored cards in shopping accounts.
How Do You Protect Your Own CVV and Card Data?
At the checkout
- Use a virtual card number from your issuer when the shop is unfamiliar.
- Pay with credit rather than debit. Credit limits the damage and gives you dispute rights.
- Use Apple Pay or Google Pay where accepted. Tokenization swaps your real number for a one-time code.
- Skip the "save my card" prompt on small or new shops.
On your devices and accounts
- Keep CVVs in a password manager, not in a notes app or photo.
- Turn on transaction alerts for every charge above a small amount.
- Keep your address and phone number current with your issuer.
- Never read your card number or CVV to someone who calls you. Banks do not ask for it.
If your card data leaks
- Call the number on the back of your card and request a new number and CVV.
- Review statements for small test charges. They often come before large ones.
- File a report at IdentityTheft.gov if your SSN or other identity data is involved.
- Report the scam to the FBI's IC3 if a seller or marketplace contacted you.
FAQ
Is buying CVV fullz a felony?
Yes. Access device fraud is a federal felony. A first offense for possession with intent carries up to 10 years in prison, and trafficking carries up to 15.
Does paying with crypto make it legal or untraceable?
No. The payment method does not change the charge. Blockchain analysis firms trace wallet flows, and US exchanges file reports on transfers that look suspicious.
How is a CVV different from fullz?
A CVV is one code on the card. Fullz is the full record of card and identity data. The CVV is one field inside a fullz file.
Is there a legal way to get card numbers for testing?
Yes, for developers. Payment processors publish test card numbers for sandbox environments. Those numbers work only in test mode and move no real money.
What to Do Instead of Searching for a Seller
If the card is yours, use your issuer's virtual card tool and set up alerts. If you need payment data for software testing, use sandbox test numbers from a processor. If someone offered you fullz, report it to IC3 and move on.