There is no legitimate place to buy fullz or CVV data. Fullz are bundles of stolen card numbers, billing addresses, and identity details, and every site advertising them is an illegal fraud market, a scam that takes payment and delivers nothing, or a law enforcement operation. If you are searching for a vendor, the honest answer is that the product is someone else's stolen account, and buying it is a federal crime in the United States.
What exactly are fullz?
The term comes from carding forums and means a "full" set of data on one person. A typical bundle includes a card number, expiration date, CVV, cardholder name, billing address, phone number, and sometimes a Social Security number or date of birth. That combination is what fraudsters need to pass address verification checks or to open accounts in a victim's name.
Is buying fullz or CVV data illegal in the US?
Yes. Trafficking in stolen payment card numbers falls under access device fraud, and possession of another person's identity data with intent to defraud is identity theft. Sentences routinely include prison time and restitution, and federal prosecutors charge buyers and sellers alike.
Purchasing the data is not a technicality. The transaction itself is the crime, even if the card is never used.
Why do fullz marketplaces look so convincing?
They are built to mimic real ecommerce, complete with escrow claims, "verified vendor" badges, and buyer reviews that the operators write themselves. The business model is the deposit, not the data. Many buyers pay in crypto and receive nothing, or receive data that was already burned by hundreds of other buyers.
- Advance payment traps: vendors demand a minimum deposit before showing a sample.
- Burned data: cards are resold repeatedly until issuers block them.
- Sting sites: some storefronts are run by investigators collecting buyer identities.
- Malware payloads: "checker" tools and sample files often install credential stealers.
How can you tell a real merchant from a criminal storefront?
Legitimate merchants never ask for your CVV by email, chat, or phone, and they never request a photo of your card. Payment happens on a secure checkout page with an HTTPS connection and a recognizable processor. A real store publishes a physical address, a return policy, and a customer service number you can call.
Treat any seller who wants payment in gift cards, crypto, or wire transfer as a fraud signal. Those methods are chosen because they cannot be reversed.
How do you protect your own card data from being sold as fullz?
Use virtual or single-use card numbers for unfamiliar sites, and keep one card dedicated to online purchases. Enable transaction alerts so an unauthorized charge reaches you in seconds, not at the end of the month. Never store your CVV in a browser or a notes app.
- Shop on sites you typed yourself, not on links from texts or ads.
- Check that the checkout domain matches the store domain before entering a card.
- Freeze your credit if your SSN may have been exposed.
- Review statements weekly and dispute unknowns fast.
What should you do if your card data shows up for sale?
Report the card as compromised, request a new number, and place a fraud alert with the credit bureaus. File a report with the FTC and the FBI's Internet Crime Complaint Center so the data point joins a larger investigation. Keep the written confirmation from your issuer in case charges reappear later.
The bottom line
Anyone offering to sell you fullz is committing a crime and, in most cases, planning to rob you too. The only safe way to hold card data is to protect your own and buy from merchants you can verify. If a deal depends on secrecy, irreversibility, or someone else's name, walk away.