Definition
A fullz is a bundle of stolen personal and financial data about one person. The term is carding slang for "full package." A CVV is the 3 or 4 digit card verification value printed on a payment card. A fullz CVV listing is a fullz record that includes the card number, expiration date, and CVV. The data is stolen. Buying, selling, or using it is a crime in the United States.
What a fullz record contains
- Full name and billing address
- Phone number and email address
- Date of birth and, in US listings, a Social Security number
- Card number and expiration date
- CVV or CVC
- In some listings, a bank login, email password, or driver license number
Fullz compared to a CVV-only listing
A CVV-only listing holds a card number, expiration date, and CVV. That data supports one card-not-present transaction. A fullz holds the same card data plus identity data. The extra fields let a buyer pass identity checks, open new accounts, or take over an existing account. Prices depend on the victim's credit profile, the account balance, and the age of the data.
How fullz data is used
Common uses include card-not-present purchases, account takeover, and new account fraud. A stolen Social Security number can support a synthetic identity that outlives the card. That is why fullz records sell at higher prices than card numbers alone.
Legal status in the US
18 U.S.C. Section 1029 covers fraud and related activity with access devices, which includes stolen card numbers and CVVs. 18 U.S.C. Section 1028 covers identity theft and the transfer of identification documents. Penalties include prison terms and fines. The FTC and the FBI Internet Crime Complaint Center collect reports from victims.
Protection for merchants
PCI DSS requires that sensitive authentication data, including the CVV, is not stored after authorization. Merchants should verify the CVV at the time of the transaction, use Address Verification Service checks, and consider 3-D Secure for card-not-present orders. Storing CVV data in a database or a log creates a breach risk and violates the standard.
Protection for cardholders
Treat the CVV like a password. Do not send it by email, text, or chat. Do not read it to a caller who claims to be from a bank or a fraud team. Banks do not ask for the CVV on an inbound call. Review statements and set transaction alerts. Report unauthorized charges to the issuer.
Terminology limits
Carding slang changes between markets. Some sellers use fullz for a record with no card data at all. Others split records into "fullz" and "fullz with CVV." The constant is stolen personal data bundled for fraud.