What does fullz for sale mean?
Fullz is a fraud-market word for a bundle of stolen personal and payment data: name, address, phone, date of birth, Social Security number, card number, expiry date, and the CVV. A fullz for sale listing, or any offer to sell CVV data, describes card and identity theft rather than a product or a service. Buying, selling, or using that data is a federal crime in the United States.
This guide covers what the trade actually is, why the buyers end up worse off, and how normal shoppers and merchants keep card data out of those listings in the first place.
Where Can I Sell Fullz: A Comprehensive Buying Guide
Is it legal to buy or sell fullz or CVV data?
No. Trafficking in stolen card numbers falls under access device fraud, 18 U.S.C. 1029, and stolen identity data falls under 18 U.S.C. 1028. A conviction can carry prison time, fines, and restitution to every victim whose card was used.
Most sellers work in groups that recruit resellers, so a buyer who passes even one card to someone else moves from user to distributor in the eyes of prosecutors. There is no license, no exchange, and no legal vendor for this data anywhere in the US.
Why CVV for sale listings are a trap for the buyer
The data is often dead or fake
Cards get canceled as soon as the real owner spots a charge, and that can happen within minutes of a test purchase. Stolen data shops have no refund policy, no support desk, and no way for a buyer to complain without exposing their own crime. Some listings are pure fiction, built from old breach dumps and random numbers that fail on the first try.
The buyer becomes the next target
Fraud markets run on aliases and escrow that nobody enforces. A buyer who pays first often gets nothing, or gets threatened with the transaction record later. Reporting the loss to police means admitting to the offense, which is why the trade stays a losing bet even on its own terms.
What is the difference between a CVV, a dump, and fullz?
- CVV-only listing: a card number plus the security code, used for online and phone orders.
- Dump: data copied from a card magnetic stripe, used to make a cloned physical card.
- Fullz: the widest bundle, adding identity data such as SSN and date of birth so a criminal can open new accounts in the victim name.
What is a CVV, and why do merchants ask for it?
A CVV is the 3-digit code on the back of most cards, or the 4-digit code on the front of American Express cards. It exists to show that the buyer holds the physical card, not just the card number.
Card network rules require the code for card-not-present orders, which covers most online stores and phone sales. The CVV is not printed on receipts and is not encoded in the magnetic stripe, so a leaked card number alone is weaker without it.
PCI DSS treats the CVV as sensitive authentication data. A merchant may pass it to the issuer during authorization, but keeping it after the sale is banned.
How does card-not-present fraud work?
Criminals collect card data from breaches, skimmers, phishing pages, and fake checkout forms. They test small purchases first to see which cards work, then move the numbers before the owner notices.
- Skimming devices on gas pumps and ATMs copy magnetic stripe data from real cards.
- Phishing emails and cloned checkout pages gather the card number, expiry, and CVV in one pass.
- Merchant breaches expose stored card numbers, though not the CVV when the merchant follows PCI DSS.
- Resellers bundle whatever they have into fullz and sell it again to other criminals.
Red flags in any CVV for sale pitch
- Crypto-only payment, which leaves the buyer with no dispute path.
- Screenshots and testimonials that cannot be checked against anything real.
- Urgency such as limited stock or a price that drops tonight.
- A push to move the chat to an encrypted app before any deal.
- A request for your own ID, bank login, or a verification fee. That is the second scam in the same conversation.
How do you protect your own card online?
- Use a virtual card number from your bank for stores you do not know. It can be locked or expired after one merchant.
- Turn on transaction alerts so every charge reaches your phone in seconds.
- Pay with a credit card rather than a debit card. The Fair Credit Billing Act caps your liability for unauthorized charges at 50 dollars, and most issuers waive even that.
- Check statements and report unknown charges within 60 days of the statement date to keep your dispute rights.
- Freeze your credit at Equifax, Experian, and TransUnion if your SSN was exposed with the card. A freeze is free and blocks new accounts.
How do merchants cut CVV fraud?
- Require the CVV on every card-not-present order and never store it after authorization.
- Use 3-D Secure, which asks the issuer to authenticate the cardholder inside the checkout.
- Tokenize card numbers so internal systems never hold the real account number.
- Check the billing address with AVS and flag orders where the shipping address differs.
- Watch velocity: many small orders from one device or IP address in a short window.
- Review refunds and chargebacks by customer, since fraud rings reuse the same shipping drop.
What should you do if your card data shows up for sale?
Assume the data is live and act the same day. Call the issuer, close the card, and ask for a new number, then file a report at IdentityTheft.gov.
If the listing included your SSN or date of birth, add a fraud alert or a credit freeze. Keep copies of every report, because banks and credit bureaus ask for them during disputes.
Frequently asked questions
Can you go to jail for buying fullz?
Yes. Buying stolen card data is a federal offense, and intent to use it counts even when no charge goes through. Sentences in access device cases include prison time plus restitution to victims.
Why does a message ask for my CVV as verification?
No bank or store asks for your full card number, expiry, and CVV by email, text, or phone. That request is a phishing pattern. Call the number on the back of your card instead.
Do legitimate stores have to ask for the CVV?
Card network rules require the code for most card-not-present transactions, so a missing CVV field at a real store is unusual. A request for the code in a chat message is a red flag.
Is there any legal market for CVV data?
No. There is no legitimate buyer for someone else card details. Any third party that offers money for card or identity data is running fraud.