Short answer
A fullz with CVV shop is a criminal storefront that sells stolen payment and identity records. The word fullz describes a bundle: cardholder name, billing address, card number, expiration date, and the three or four digit security code printed on the card. No licensed business sells this data. Buying it, selling it, or using it breaks US federal law.
What a fullz bundle holds
Sellers combine several data points so a buyer can pass a card through an online checkout without holding the plastic. A bundle can include:
- Name, billing address, phone number
- Card number, expiration date, CVV or CVC
- Social Security number or date of birth
- Email login or bank account details in larger packages
Sites that call themselves shops copy normal ecommerce design. They post listings, ratings, and escrow terms. The catalog is stolen property. Many of these sites also cheat their own buyers, so the inventory and the reviews carry no guarantee.
Why the CVV is the target
Card networks added the CVV to prove the physical card was in hand. The code is not stored in the magnetic stripe and merchants may not keep it after authorization. A thief who holds only a card number hits a wall at checkout. A thief who holds the CVV clears that check. This is card-not-present fraud: no card is swiped, no signature is collected, and the charge lands on a real account.
The legal position
Federal law covers this ground. Trafficking in access devices falls under 18 U.S.C. 1029. Identity theft falls under 18 U.S.C. 1028. Penalties include prison terms and fines, and the statutes apply to buyers as well as sellers. State law adds charges in most jurisdictions.
How the data leaves an account
Records reach criminal markets through skimmers on fuel pumps and ATMs, phishing pages that clone a bank login, retailer breaches, and malware on personal computers. Some bundles come from inside jobs at call centers. A single breach can supply thousands of records, which is why prices per record are low.
What cardholders can do
- Turn on multifactor authentication for bank and email accounts.
- Use virtual card numbers for online purchases when the issuer offers them.
- Read statements each month and dispute unknown charges in writing.
- Place a free credit freeze with Equifax, Experian, and TransUnion.
- File a report at IdentityTheft.gov if a Social Security number was exposed.
What merchants can do
- Require CVV verification on every card-not-present order.
- Run Address Verification Service checks and flag mismatches.
- Support 3-D Secure authentication for higher-risk transactions.
- Watch for velocity spikes: many orders, one IP address, one shipping address.
- Keep card data out of internal systems so a breach yields nothing usable.
If your data is exposed
Reports of identity theft to the Federal Trade Commission passed one million in recent years. Recovery steps are free. Contact the card issuer, then the credit bureaus, then the FTC. Report card fraud to the FBI Internet Crime Complaint Center. Keep a written log of dates, names, and case numbers.