Short answer: "fullz" and "CVV dumps" are packages of stolen card and identity data sold on underground forums, and buying them is a federal crime in the US, not a shortcut. Most listings are also scams, and much of what does get delivered is already dead. Here is what the terms mean, why the trade fails on its own logic, and where real fraud defense happens.
What the two terms describe
A "fullz" is a bundle. It typically pairs a card number and expiration with the cardholder's name, address, phone, date of birth, sometimes a Social Security number, and sometimes bank or email credentials. The point of the bundle is that it can support more than one kind of fraud: card-not-present purchases, account takeover, loan applications.
"Dumps" are different. They are the raw magnetic-stripe track data that sits on the back of a card, sold in bulk and priced by the issuing bank's country and card tier. In the US, dumps are tied to the older magstripe fallback path, which is exactly why EMV and tokenization gutted their resale value.
Why the purchase side is a trap
- Escrow on these markets is theater. Admins run exit scams, and "rippers" sell the same bundle to a dozen buyers.
- Base data burns fast. One attempted charge with a mismatched CVV or billing ZIP flags the account, and the issuer kills the card.
- Card-not-present checks catch most of it. Address Verification System mismatches, CVV2 validation, and 3-D Secure step-ups stop transactions that look fine on paper.
- Law enforcement works these markets. Takedowns of carding shops and the arrests that follow are routine, and forum logs become evidence.
I have watched buyers in these channels get burned more often than not. The economics are bad by design: the seller knows the card's shelf life is hours, so the price is set to extract maximum value before the buyer notices.
The legal exposure is not theoretical
In the US, trafficking in stolen access devices falls under 18 U.S.C. Section 1029, identity documents under Section 1028, and the underlying purchases under wire fraud statutes. Volume matters at sentencing. A single bulk order can pull in enhancements that turn a few hundred dollars of "product" into a multi-year exposure. Civil liability follows too, since issuers and merchants pursue chargebacks and restitution.
What issuers and networks actually see
Every card-not-present transaction carries a fingerprint: device, IP, geolocation, velocity across BIN ranges, and the history of the merchant account. Issuers score that in real time. A card that has never been used online, suddenly charging a high-risk merchant from a mismatched region, trips rules before the authorization completes.
Tokenization changed the math further. When a checkout uses network tokens, the number on file is a substitute that only works for that merchant and device. A stolen PAN does nothing with it. EMV 3-D Secure adds a step-up challenge that a fraudster holding only a fullz cannot pass.
If you run a checkout, this is the defensive checklist
- Never store the CVV2 after authorization. PCI DSS forbids it, and a stored CVV turns a breach into a catastrophe.
- Enforce AVS and CVV checks on first orders, and review the exceptions instead of auto-approving them.
- Turn on 3-D Secure for high-risk categories and new customers, not for everyone.
- Watch for BIN attacks: many small authorizations across a range of card numbers in a short window.
- Flag reshipper and freight-forwarder addresses on high-ticket items, since those are the preferred drop points.
If you carry a card
Use virtual card numbers for online merchants, keep purchase alerts on, and freeze your credit files rather than paying for monitoring. If a charge looks wrong, call the issuer and ask for a new number instead of waiting for the dispute to play out. A card replaced in an hour is a card that cannot be sold as a fullz.
Bottom line
The "fullz cvv dumps buy" search leads to a market built on short shelf lives, fake escrow, and felony exposure. The data is stale by the time it arrives, and the defenses on the other side are better than the listings admit. The useful takeaway is on the defense side: validate CVV, never store it, tokenize, and treat every first-order anomaly as worth a second look.