The short answer
There is no legal place to sell CVV fullz in the United States. Selling, buying, or transferring stolen card data violates 18 U.S.C. § 1029. A first conviction carries up to 10 years in prison and a $250,000 fine. The forums, Telegram channels, and carding shops that list this data operate outside the law. Some are run by law enforcement. Others are run by criminals who take payment and close the account.
What a fullz record contains
A fullz is a bundle of personal and financial data tied to one person. It sells for more than a bare card number because it supports account takeover.
- Card number, expiration date, and CVV or CVC code
- Cardholder name and billing address
- Social Security number and date of birth
- Mother's maiden name and security answers
- Online banking username and password
- Phone number and email address
A bare card number plus CVV is called a "CVV" or a "dump" in that trade. Fullz add the identity layer.
How the data gets stolen
- Skimmers placed on fuel pumps and ATMs
- Phishing pages that copy a bank login
- Point-of-sale malware on merchant terminals
- Breaches at retailers, processors, and health insurers
- SIM swaps and phone support fraud
The FTC logged about 1.1 million identity theft reports in 2023. Credit card fraud was the most reported type in that group.
Why sellers lose money
Card data expires fast. An issuer voids a number as soon as the holder files a fraud claim. A batch of 50 fullz can be dead within a day.
- Escrow fraud: the escrow service keeps the funds and closes
- Rippers: buyers dispute the sale after they receive the data
- Honeypots: agents run the marketplace and log every account
- Chargeback rules that reverse the stolen money
No forum offers refunds, contracts, or recourse. A seller who gets cheated has no legal claim, because the sale itself is a crime.
Penalties and civil risk
18 U.S.C. § 1029 covers access device fraud. 18 U.S.C. § 1028A adds a mandatory 2-year term on top of the fraud sentence. State laws add charges. Victims can sue for damages under state consumer protection statutes.
What to do with card data you find
If you handle cardholder data and find a leak, do not sell it and do not keep it. Report to the FBI Internet Crime Complaint Center. Notify the issuing bank. If you run a merchant site, follow PCI DSS requirements for storage and transmission.
If your own data is exposed
- Freeze your credit at Equifax, Experian, and TransUnion. The freeze is free.
- File a report at IdentityTheft.gov and get a recovery plan.
- Call the card issuer, report the fraud, and request a new number.
- File a police report. Some disputes require it.
- Report the incident to the FTC and to IC3.
Legal work in card security
Card data protection employs fraud analysts, PCI auditors, and security engineers. Pay starts near $70,000 for an analyst and passes $150,000 for a lead engineer at a large issuer. These roles are legal. Hiring continues.