There is no legal place to sell fullz. Selling fullz, which are bundled packages of stolen card numbers, cardholder names, addresses, and sometimes SSNs or CVV codes, violates US federal law under 18 U.S.C. § 1029, which covers trafficking in access devices. Every venue that advertises itself as a place to sell them, whether a carding forum, an invite-only Telegram channel, or a darknet marketplace, is either a scam that takes the seller's cut and vanishes, a honeypot, or a place where the seller is the most exposed party in the room. This guide explains the legal reality, why those venues fail, and what to do instead if you are a cardholder whose data is already circulating or a security professional who wants to work with payment data legitimately.
selling fullz with cvv on telegram
What fullz actually are
A fullz record typically combines a primary account number, expiration date, CVV or CVC, cardholder name, billing address, and often a phone number or partial government ID. That combination is exactly what a merchant's checkout page, a card-not-present fraud filter, and a bank's risk engine are built to verify against. It is also exactly what makes the record a federal access device under US law rather than a curiosity. There is no research exemption for buying or selling one.
The legal picture in the United States
- 18 U.S.C. § 1029: criminalizes producing, selling, transferring, or possessing access devices with intent to defraud. Penalties scale with the value and volume involved and can reach years in prison.
- 18 U.S.C. § 1028: applies when identity documents or identifiers are involved, which is common in fullz bundles.
- State law: most states add their own identity theft and computer crime statutes on top of the federal charges.
- Liability does not stop at the seller: hosting, brokering, or even holding inventory can be charged.
Why every "place to sell" is a losing proposition
Carding forums and marketplace clones
- Pros: none that hold up outside the seller's imagination.
- Cons: escrow is run by the same people who can read your listing, exit scams are routine, and buyer disputes are settled by whoever holds the wallet. Many are seeded by researchers or law enforcement.
Encrypted chat channels
- Pros: low friction to post.
- Cons: no recourse, no verification, and a persistent record tied to a device and account. Buyers routinely dispute after receiving data and demand refunds.
Darknet markets
- Pros: an appearance of structure.
- Cons: takedowns are common, administrator arrests have followed, and historical transaction logs have been used as evidence years later.
The pattern across all three is the same: the seller absorbs nearly all the legal risk while the platform takes the money.
If you found fullz or your own data is being sold
- Do not buy, test, or forward the data. Possession with intent is itself chargeable.
- Report it to the FBI Internet Crime Complaint Center, which collects reports of internet-facilitated financial fraud.
- If the data is yours, file a recovery plan at the FTC's IdentityTheft.gov and place a freeze or fraud alert with all three credit bureaus.
- Notify the issuing bank of the affected card so it can reissue the number.
- If you are a merchant or processor and the data came from your systems, engage your incident response and card network obligations.
Legitimate ways to work with payment data
If the interest in fullz is really an interest in card security, there are real career paths: fraud analyst roles at issuers and processors, PCI DSS assessment work, bug bounty programs that pay for responsibly disclosed card-handling flaws, and academic research on card-not-present fraud. These pay in salary and bounties rather than in the resale of someone else's identity, and they do not end with a grand jury.
Protecting your own cards from fullz-driven fraud
- Use virtual or single-merchant card numbers where your issuer offers them.
- Prefer tokenized wallets over entering raw card numbers on unfamiliar sites.
- Check statements weekly rather than monthly so a test charge is caught early.
- Treat any email or chat offering to buy or sell card data as a scam aimed at you.