The short answer
Nowhere legal. "Fullz" is a fraud-world word for a bundle of stolen identity data: card number, expiry, CVV, plus the cardholder's name, billing address, and often a Social Security number or date of birth. "CVV" in that phrase just means the three- or four-digit code printed on the card. No storefront, forum, or chat channel sells that data lawfully. I treat every site promising it as either a scam or a trap, and usually both.
That answer isn't me being coy. It's the actual state of the market, and understanding why saves people a lot of money and legal trouble.
Buy Fullz CVV Cheap: A Comprehensive Buying Guide
What you're really searching for
People land on this query from two directions. Some want to buy card data. Others had their own data exposed and are trying to figure out how bad it is. The two groups need very different things, so it helps to be honest with yourself about which one you're in.
If it's the first: the thing you're picturing, a reliable shop with real cards and refunds, doesn't exist. If it's the second: your card is probably already being sold, and the useful move is damage control, not shopping.
Why every "vendor" is a bad bet
- Most are pure scams. The classic play is a small upfront "verification" payment, then a demand for more, then silence. The cards, if any arrive, are usually dead or generated.
- Some are law enforcement. Carding forums get seized and replaced with lookalike honeypots. Federal cases regularly start with someone buying a single test card.
- Buying is the crime, not just selling. In the US, trafficking in stolen access devices falls under 18 U.S.C. § 1029, and the penalties scale with volume. A $20 purchase can be a felony.
- The data is often stale. Breach dumps circulate for years. Card issuers kill compromised numbers fast, so you'd be paying for expired inventory.
Why real businesses never have CVV data to sell
PCI DSS forbids storing the CVV or CVC after a transaction is authorized, even in encrypted form. That single rule is why a genuine merchant database has no CVV field to leak. When you hear about a breach that included CVVs, it usually means a skimmer grabbed the data in transit or a call center wrote it down, not that a payment processor was holding it.
So when a seller claims to have "fresh fullz with CVV," ask where the data came from. There's no compliant answer. That's the tell.
If your own card data turned up somewhere
- Freeze or lock the card in your banking app. It takes about thirty seconds and stops the bleeding.
- Pull your free credit reports and look for accounts you don't recognize.
- Place a free credit freeze with all three bureaus if your SSN was in the bundle. A freeze beats a fraud alert because it blocks new accounts outright.
- Change passwords on banking and email, and turn on multi-factor authentication. Email is the reset key for everything else.
- File a report at IdentityTheft.gov and, if money was actually taken, at IC3. The paper trail matters for disputing charges and for your records.
How to check a card before you trust a checkout
The safer question isn't where to find CVV data, it's whether the site asking for yours deserves it. Look for a padlock and a real business address, pay with a credit card rather than a debit card, and use a virtual card number when your bank offers one. Those single-use numbers exist precisely because card data leaks.
One more habit that pays off: keep a separate card for subscriptions and online orders. When it gets compromised, and eventually one will, you swap it without touching the card tied to your rent.