Buying CVV fullz is a federal crime in the United States, and the data on sale often fails. This page does not sell card data or walk through a purchase. It covers what fullz are, what the law says, and what buyers lose.
What is a CVV fullz?
A fullz is a package of stolen card data: card number, expiry date, CVV code, cardholder name, billing address, and often a Social Security number or date of birth. Sellers bundle it so a buyer can attempt card-not-present charges or open accounts in a victim's name.
The CVV is the three or four digit code printed on the card. Payment networks treat that code as proof the buyer holds the physical card. Data without a valid CVV sells for less because it clears fewer checks.
Is buying fullz illegal in the US?
Yes. 18 U.S.C. § 1029 covers the sale, transfer, and possession of stolen access devices, with penalties up to 10 years for a first offense and 15 years for repeat offenses. 18 U.S.C. § 1028A adds a mandatory two-year term for identity theft, served consecutively to any other sentence.
State laws add charges on top, and Canada, the UK, the EU, and Australia have matching statutes. Prosecutors do not need a completed purchase. Attempt and conspiracy counts apply to a chat log alone.
What actually happens when someone tries to buy fullz
- Exit scams. Many storefronts take crypto, deliver a file, and vanish. Payment is irreversible by design, so a bad order has no refund path.
- Dead data. Banks cancel compromised cards fast. A batch that sat in a seller's inventory for weeks clears few or no charges.
- Malware in the delivery. Files and "validity checkers" ship with infostealers that harvest the buyer's own bank logins and crypto wallets.
- Stings. Card shops run by law enforcement and by informants take orders and log IP addresses, wallets, and shipping details.
- Repeat victimization. A buyer who pays once lands on a sucker list and gets targeted by other shops.
What does a fullz purchase really cost?
The sticker price is the smallest cost. Card issuers and merchants push chargeback losses back onto the party that accepted or initiated the charge, and banks close accounts tied to fraud with the balance frozen.
Sentencing in card fraud cases weighs the total intended loss, not the amount that cleared. A file of 500 records can push a case into a higher offense level under the federal sentencing guidelines.
Add the practical fallout: device seizure at a border or a raid, loss of a job that requires a background check, and a felony record that blocks housing, loans, and many licenses.
What should you do if you already bought card data?
- Stop using it. Every further transaction adds a count.
- Talk to a criminal defense attorney before talking to anyone else, including a seller or a forum moderator.
- Wipe the device that held the files and change passwords on any account tied to the purchase.
- If your own card data leaked, report it at IdentityTheft.gov and request a fraud alert with the three credit bureaus.
Where does card data work legitimately?
Card data handling is a real career. Fraud analysts, risk teams, and payment engineers work with live transaction data every day under contracts and supervision.
The PCI DSS standard sets the rules for storing, transmitting, and tokenizing cardholder data. Tokenization replaces a card number with a surrogate value, so a breach exposes nothing usable.
Those roles pay salaries and carry no prison exposure. Carding does neither.
Frequently asked questions
Do fullz ever work?
Some records clear a charge before the issuer kills the card. That single success is what turns a curious buyer into a defendant, and it does not repeat.
Is buying fullz a felony?
Yes, in the US it falls under access device fraud, a felony with a statutory maximum of 10 years. Identity theft counts add a mandatory two years.
Can a seller be trusted to deliver valid data?
No. A seller of stolen data has no legal recourse and no reputation to protect, so a promise of "100% validity" carries no weight.
How do I check if my own card data leaked?
Review statements for small test charges, freeze your credit with all three bureaus, and report confirmed fraud to your issuer and to the FTC.