Short answer
There is no legal place to sell CVV fullz. In the United States, selling a card number, CVV, and matching identity data is a federal crime. The term fullz is criminal slang for a complete stolen record: name, address, card number, expiry, CVV, and often a Social Security number and date of birth. Any market that trades these records is a criminal market, and buying or selling there carries prison time.
What a fullz record contains
A record sold under that label usually bundles several fields that belong to one person:
- Card number, expiry date, and 3-digit CVV or CVC
- Cardholder name, billing address, phone number
- Social Security number and date of birth in some listings
- Online banking login or account balance in some listings
Each field belongs to a person who did not consent to the sale. Bundling them raises the harm. The record supports card fraud and identity theft at the same time.
Legal status in the US
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. It applies to producing, selling, and possessing card data with intent to defraud. Penalties include fines and prison terms measured in years. 18 U.S.C. § 1028A adds a mandatory 2-year term for aggravated identity theft, served after the sentence for the underlying offense. State laws add charges for larceny and computer trespass.
Federal agencies run takedowns of card marketplaces. The DOJ announces these actions through its press releases. The FBI Internet Crime Complaint Center publishes yearly reports on card fraud losses reported by victims.
How stolen card data moves
Stolen records circulate on closed forums and private chat channels. Sellers use escrow accounts and reputation scores. Buyers test small charges first. This activity sits inside a chain of data breaches, skimming devices, and phishing kits. The chain is the target of most card security work.
Where CVV data does move in legal channels
A CVV is used in one place: an authorization request sent to the issuer. Legitimate flows keep the value out of storage. PCI DSS requirement 3.2 forbids storing the CVV2 after authorization, even in encrypted form. Merchants send the value to a payment processor and keep a token in return. Tokenization replaces the card number with a reference that has no value outside that processor.
What a merchant should do
- Never store CVV values in a database, log, or CRM note.
- Use hosted payment fields so card data never touches your servers.
- Turn on 3-D Secure for card-not-present orders above a set value.
- Keep PCI DSS scope small by segmenting the network that handles card data.
- Train staff to report requests for card data by email or phone.
If your own card data is exposed
Call the issuer using the number on the back of the card. Ask for a block and a replacement card with a new number. Change the password on the account tied to the card. Place a free fraud alert or credit freeze with the three credit bureaus. Report the event at IdentityTheft.gov and at the FBI IC3 portal. Keep records of each call and each confirmation number.
Common questions
Can I sell my own card data for testing? No. Card networks and processors supply test card numbers for development. Those numbers route to sandbox environments and carry no value.
Is a CVV the same as a password? No. A CVV is a 3-digit check value printed on the card. It is not a secret shared with the cardholder for account access.
Does a VPN or crypto payment make a card market legal? No. The payment method does not change the legality of the sale.