The request I won't fill
You asked for the best place to sell fullz. I'm not going to rank that. Not because the topic is uncomfortable, but because "fullz" is a bundle of stolen identity data, and selling it is identity theft and access device fraud under US law, including 18 U.S.C. § 1028 and § 1029. A comparison page that names marketplaces is a how-to guide for a felony, and it would hurt the exact people this site exists to protect.
CVV Fullz Pricing Guide: What to Know Before Buying
So here is the comparison I can write honestly: what a fullz record actually holds, why it still beats a lot of online checkouts, and which defensive tools I would reach for first if I were shopping online today.
What is inside a fullz listing
The term is shorthand for a complete enough profile to pass as someone. In the records I have seen described in fraud reports and breach notifications, a full one tends to include:
- Legal name, date of birth, and Social Security number
- Billing address and phone number tied to the account
- Card number, expiration date, and CVV or CVC
- Sometimes a bank login, security answers, or a copy of an ID
The CVV is the piece that makes it work online. Card-not-present merchants can't check a physical card, so the three or four digit code, paired with a matching billing address, becomes the whole proof of possession.
Why a CVV check by itself is thin armor
CVC verification only proves someone has the number printed on the card. If the data came from a skimmer, a phishing page, or a merchant breach, the attacker has the code too. That is why the security value of CVV drops the moment the full record leaks together. Address verification helps a little, but a fullz bundle includes the right address by design. The controls that actually raise cost for an attacker sit elsewhere: tokenization, device and behavioral signals, and step-up authentication at the moment of payment.
The defensive stack I would pick first
If I were ranking protections rather than marketplaces, the order would look like this:
- Tokenized virtual cards. A single-use or merchant-locked number means a leaked token is worthless anywhere else, and modern networks treat the cryptogram as the real credential.
- 3-D Secure style step-up. An in-app approval or biometric check at checkout stops a reused CVV cold, because the attacker does not hold the second factor.
- Card controls and alerts. Per-transaction limits, online-purchase toggles, and instant push alerts catch the first test charge, which is usually small.
- A credit freeze. Free at all three US bureaus, and it blocks new-account fraud that fullz data enables even when the card is replaced.
If your data is already circulating
Assume it is, and act in this order. Freeze your credit with Equifax, Experian, and TransUnion. Report the theft at IdentityTheft.gov and follow the recovery plan it generates. Request a new card number rather than a reissue with the same digits. Change passwords on any account that used the same email and reuse pattern, and turn on app-based two-factor authentication. Watch for tax refund fraud and unfamiliar medical bills, both classic fullz fallout. If you have lost money, file a complaint with the FBI's Internet Crime Complaint Center.
If you run into a listing
Report it rather than engage with it. The FTC takes identity theft complaints, IC3 handles the criminal side, and your card issuer's fraud line wants the number flagged even if no charge landed. Merchant side, the fix is unglamorous: keep cardholder data out of your systems wherever tokenization can replace it, and let the network hold the cryptographic proof instead of your database.