Short answer: there is no legitimate price list
"Fullz" is carding slang for a bundled identity record: card number, expiration date, CVV, plus the cardholder's name, billing address, and often SSN or date of birth. Add "CVV" and you have the one piece that makes card-not-present fraud work. Search for pricing on it and you will find forums, Telegram channels, and paste sites quoting numbers. Those numbers are not a market rate. They are marketing copy.
If you came here to buy, stop. Trafficking in stolen card credentials is a federal offense in the US under 18 U.S.C. § 1029, and it gets prosecuted. The listings are also mostly rippers. You pay in crypto, you get a junk file or nothing, and you have no recourse, because you cannot file a complaint about a fraud you were in the middle of committing. A large share of these shops are run by scammers, and some are honeypots.
Why the quoted prices vary at all
- Issuer BIN and card type. Premium-brand cards and certain banks carry higher asking prices because they are assumed to have higher balances.
- Region. US and EU records are priced differently from records from other regions.
- Bundling. A bare card number is worth less than one with a matching billing address, and far less than one with SSN, date of birth, and ID scans attached.
- Freshness and "non-VBV" claims. These push the asking price up, but nothing in the listing can be verified before you pay.
- Volume tiers. Bulk discounts exist, which tells you what the sellers already know: the data gets burned fast.
In published threat intelligence, single records typically trade for roughly the price of a cup of coffee. That is not a sign of value. It is a sign of how quickly issuers and processors shut compromised accounts down.
Buy Fullz and CVV Shop: A Comprehensive Buying Guide
Pitfalls, mostly for defenders
Do not buy anything to "check" whether your own data is exposed. That would mean committing the offense to test for the offense, and the file you get back is worthless as evidence anyway.
- Freeze your credit at all three US bureaus. It is free and it blocks most new-account fraud.
- Report identity theft at IdentityTheft.gov and file an FTC complaint. That creates the paper trail banks and insurers ask for.
- Businesses that get hit with card-not-present fraud should file with the FBI's IC3, not just their processor.
- Merchants: require CVV and AVS on every transaction, turn on 3D Secure for high-risk orders, and never store CVV after authorization. That is a PCI DSS requirement, not a suggestion.
- Watch out for the second wave. People whose fullz circulate get targeted with convincing phishing and SIM-swap attempts months later, because the bundle included a phone number or email.
Where the real leverage is
Pricing chatter is a lagging indicator. It tells you data is already loose. The useful work happens upstream: tokenization, network tokens instead of stored PANs, step-up authentication on risky orders, and monitoring for the credential-stuffing that usually precedes a fullz bundle showing up for sale. If you run an online store, I would rather see you spending on those controls than reading market gossip about what a record "should" cost.