Selling fullz or CVV data online means trading stolen personal records and payment card numbers for money. In the United States that trade is identity theft and wire fraud, not a gray market. Sellers face prison, fines, and restitution, and buyers face the same charges.
This guide explains what the terms mean, which laws cover the sale, and what consumers can do when their data shows up in a criminal listing.
What do the terms "fullz" and "CVV" mean?
"Fullz" is slang for a complete identity record: name, address, date of birth, Social Security number, and account details. "CVV" is the three or four digit security code printed on a payment card, and in fraud slang the word often stands for a full card record with that code attached.
Criminals bundle those records because a card number with a matching billing address is easier to use than a bare number. The bundles come from data breaches, skimming devices, phishing pages, and malware on point-of-sale terminals.
Is it legal to sell fullz or CVV data online?
No. Every US state and the federal government treat the sale of stolen identity and card records as a crime. There is no licensed marketplace, no broker, and no legal reseller for this data.
A single listing can trigger several charges at once, which is why federal prosecutors stack counts against one defendant.
Which federal laws apply?
- 18 U.S.C. § 1028 covers fraud tied to identification documents and information, including Social Security numbers and dates of birth.
- 18 U.S.C. § 1028A adds a mandatory two-year term for aggravated identity theft when the data is used during another felony.
- 18 U.S.C. § 1029 covers access device fraud, the statute aimed at card numbers, CVV codes, and card-making equipment.
- 18 U.S.C. § 1343 covers wire fraud, which applies when the sale happens over the internet.
- 18 U.S.C. § 1030 covers computer fraud when the records came from a hacked system.
What penalties do sellers face?
Access device fraud under § 1029 carries up to 10 years for a first offense and up to 20 years for a second. Aggravated identity theft adds a mandatory 24 months on top of any other sentence.
Courts also order restitution to banks and victims, and the total can reach millions when a defendant sold thousands of records. Forfeiture of computers, phones, and crypto holdings is standard.
Why buyers get caught too
Card data bought from a criminal listing is often already dead, meaning the bank closed the account. Buyers who test the numbers leave a trail of failed authorization attempts that card networks flag.
Payment for the data is evidence in itself. Crypto transfers, chat logs, and delivery addresses hand investigators a chain that ends at the buyer.
How stolen card data reaches ordinary people
- Skimmers on gas pumps and ATMs copy card stripes and keypad entries.
- Phishing emails and texts ask for card details or one-time codes.
- Retail and health care breaches expose millions of records at once.
- Malware on a checkout terminal captures numbers before encryption.
Once a record is loose, it may be resold within hours. That speed is why monitoring and fast card replacement beat after-the-fact cleanup.
How can you protect yourself?
- Freeze your credit at all three bureaus. A freeze blocks new accounts opened in your name and can be lifted when you apply for credit.
- Turn on transaction alerts in your banking app for every purchase over a small amount.
- Use a virtual card number for online shopping. It expires after one merchant or one purchase.
- Check your card statements each month and your credit reports at AnnualCreditReport.com.
- Never share a CVV or a one-time passcode with anyone who calls, texts, or emails you.
Frequently asked questions
Is buying CVV data a crime in the US?
Yes. Buying stolen card records falls under access device fraud and often wire fraud as well. Intent to use the data is not required for a charge.
What should I do if my data shows up in a breach?
Freeze your credit, replace the affected cards, and change passwords on any accounts that reused the same login. Then file a report at IdentityTheft.gov.
Where do I report card fraud?
Report to your bank first, then file a complaint with the FTC at IdentityTheft.gov and the FBI's Internet Crime Complaint Center. A local police report helps when you need an identity theft affidavit.
Do card networks ever sell card data?
No. Visa, Mastercard, and card issuers move account data through licensed processors under strict rules. Any site that sells card numbers in bulk is trading stolen records.