You cannot buy fullz or CVV data from any legal source. In the United States, buying, selling, or holding stolen card numbers is a federal crime under 18 U.S.C. § 1029, and the sites that advertise fullz are run by scammers, criminals, or undercover agents. There is no storefront, forum, or Telegram channel where this purchase is safe, refundable, or lawful.
What is a fullz listing?
A fullz is a bundle of stolen personal and payment data sold as one record. The name comes from 'full information,' and the price rises with the amount of data in the bundle.
- Card number, expiration date, and the 3-digit CVV or 4-digit CVC
- Cardholder name, billing address, and phone number
- SSN, date of birth, and mother's maiden name in the higher-priced tiers
- Bank name, card limit, and sometimes the current balance range
A fullz with an SSN sells for more than a bare card number because it feeds more fraud types, from card-not-present purchases to new account openings.
Why almost every fullz seller is a scam
Carding markets have no consumer protection, no refund policy, and no court to appeal to. That structure attracts thieves who rob other thieves, and it gives buyers no way to verify anything before they pay.
The ripper problem
A ripper is a seller who takes payment and delivers nothing, or delivers data that fails at checkout. Forum moderators ban some of them, but the crypto is already gone.
Dead cards in every batch
Banks cancel compromised cards when fraud is detected or when the real owner disputes a charge. Sellers mix one live card into a batch of dead ones to make the batch look valid.
Escrow run by the same people
Escrow services in these markets are often operated by the sellers themselves. There is no dispute process, because reporting the transaction means reporting your own crime.
Undercover operations
Federal agents monitor carding forums and run their own storefronts. Buyers get charged alongside sellers in these cases, and the chat logs become the evidence.
What are the legal penalties for buying fullz?
18 U.S.C. § 1029 covers fraud and related activity with access devices, which includes card numbers and CVVs. A first offense carries up to 10 years in prison, and trafficking offenses can carry up to 15.
Charges stack. Buying fullz to make purchases adds identity theft and wire fraud counts, and using another person's SSN can add charges under 18 U.S.C. § 1028.
- Prison time plus fines per count
- Restitution to the bank and the cardholder
- Immigration consequences for non-citizens, including removal
How does card data end up in a fullz bundle?
- Skimmers on gas pumps and ATMs that copy the magnetic stripe
- Phishing pages that clone a real checkout form
- Breaches at merchants and payment processors
- Malware on a phone or laptop that reads saved card data
- Inside theft by staff with access to payment systems
One stolen record gets resold many times. That is why the same card number can appear in ten different listings on ten different forums.
Why does the CVV exist at all?
The CVV is a check digit the issuer computes from your card number, expiration date, and a secret key. It is not stored on the magnetic stripe, so a skimmer does not capture it. Online merchants ask for it to prove the buyer holds the physical card.
Tokenization goes one step further. The merchant keeps a token instead of your number, so a breach at that merchant exposes nothing a thief can reuse.
How do you protect your own CVV and card data?
- Do not read your CVV aloud in a store or on a call where others can hear
- Keep card numbers out of notes apps, email drafts, and spreadsheets
- Use virtual card numbers from your bank for subscriptions and unfamiliar sites
- Turn on transaction alerts so you see charges the moment they post
- Avoid any checkout page that asks for your SSN or full date of birth
- Freeze your credit at all three bureaus if your SSN may be exposed
How do you find out if your card is for sale?
You cannot browse carding markets, and you should not try. The practical checks are your own statements and your credit file.
- Review your card statements each week, line by line.
- Set alerts for any charge above a small threshold.
- Pull your free credit reports and look for accounts you did not open.
- Report fraud to your bank within days, not weeks.
Under the Fair Credit Billing Act, your liability for unauthorized credit card charges caps at $50. Debit card protection depends on how fast you report the loss, so speed matters.
What should you do if your card data appears online?
- Call the number on the back of your card and request a new number and CVV.
- Change passwords on your bank and email accounts, and use a password manager.
- Place a free credit freeze with Equifax, Experian, and TransUnion.
- File a report at IdentityTheft.gov to build a recovery plan and an FTC affidavit.
- File a complaint with the FBI's IC3 if money was taken from your account.
FAQ
Is buying fullz a crime in the US?
Yes. 18 U.S.C. § 1029 makes it a federal offense to buy, sell, transfer, or possess stolen access devices, and that includes card numbers and CVVs. Prosecutors do not need to prove you used the card to bring charges.
Do CVV shops ever send real card data?
Sometimes, because the seller stole the data earlier. That does not make the purchase legal, and the card gets canceled once the real owner disputes the charge. Most sites that demand crypto upfront deliver nothing at all.
What is the difference between CVV, CVC, and CVV2?
They are the same code on your card, just named by different networks. Visa calls it CVV2, Mastercard calls it CVC2, and American Express prints a 4-digit CID on the front.
Can a VPN hide a fullz purchase?
No. Payment trails, chat logs, and shipping addresses give investigators what they need, and a VPN does not change the legality of the transaction.
Is it legal to research carding markets?
Reading public reporting and security research is legal. Registering on a forum, buying data, or testing stolen cards is not, even if the goal is curiosity.
Bottom line
There is no safe or legal path to buying fullz CVV data. The listings are criminal, the sellers lie, and buyers face prison while the seller keeps the crypto. If card security interests you, study how CVV checks and tokenization work, then apply that knowledge to your own accounts and your own checkout flow.