Fullz
Fullz is criminal slang for a complete package of stolen personal information about one person — name, date of birth, Social Security number, address, and often bank or card details and answers to security questions. The name comes from “full information.” Completeness is what gives it value.
| Term origin | Criminal shorthand for “full information” |
| Minimum contents | Name, date of birth, Social Security number or national ID, address |
| Premium contents | Bank credentials, card numbers with CVV, driver’s license image, security answers, credit score |
| Sold via | Dark web marketplaces, encrypted messaging channels, closed forums |
| Pricing logic | Priced on completeness, freshness, and the victim’s credit profile |
| Primary uses | New account fraud, account takeover, tax refund fraud, loan applications |
| Relation to synthetics | Supplies the real identifiers that fabricated identities are built around |
| Distinguishing feature | Enough data to answer knowledge-based authentication as the victim |
How it works
A card number alone supports one kind of fraud: card-present or card-not-present transactions until the card is cancelled. Fullz supports a different and more durable kind, because it contains enough to become the person rather than merely spend as them.
The distinction is knowledge-based authentication. A fraudster with fullz can answer the questions institutions use to confirm identity over the phone or online — prior addresses, mother’s maiden name, which of these four lenders you have a loan with. Those questions assume only the real person knows the answers. A complete data package invalidates that assumption entirely.
Packages come from breaches, phishing, credential stuffing against reused passwords, malware on personal devices, and increasingly from fraudulent job or rental applications that harvest exactly the data a legitimate application requires. Prices vary with completeness and freshness — a package including a driver’s license image and a high credit score commands a substantial premium, because it unlocks lending rather than just spending.
Fullz also feeds synthetic identity fraud. The real identifier at the center of a synthetic identity frequently comes from a purchased package, particularly SSNs belonging to children or the deceased, which are sold specifically for that use.
Why it matters for identity verification
Fullz is the reason data-based identity verification has stopped working on its own, and the reason is structural rather than a matter of degree.
Verification that asks what someone knows assumes personal data is private. Fullz makes that assumption false for a large share of the population — the data is not secret, it is inventory. Knowledge-based authentication does not degrade gracefully against it; it fails completely, and it fails in the fraudster’s favour, because a buyer reading from a file answers more consistently than a genuine customer recalling a decade-old address.
What fullz does not contain is a face. A package can supply every biographical detail and cannot supply a live human who resembles the victim’s document portrait. That asymmetry is the entire argument for document plus biometric verification: it asks for something the market cannot sell. Linking identity attributes across accounts adds the second constraint, because a single purchased package used across many institutions surfaces as a pattern even when each individual application looks clean. Microblink’s stolen and synthetic identity detection is built on both.
Fullz vs card data
| Fullz | Card data (dumps) | |
|---|---|---|
| Contents | Full identity profile | Card number, expiry, CVV, sometimes track data |
| Enables | Opening accounts, taking over accounts, applying for credit | Making transactions |
| Shelf life | Years — SSNs and dates of birth do not change | Days to weeks, until the card is cancelled |
| Price | Higher, scaling with completeness and credit profile | Lower, often sold in bulk |
| Victim awareness | Often none until credit is applied for | Fast — statements and alerts |
| Countered by | Document and biometric verification | Tokenization, 3-D Secure, transaction monitoring |
Card data is a spending problem with a short fuse. Fullz is an identity problem with a long one, and the controls that address the first do nothing about the second.
What it can’t do
It cannot produce a genuine identity document. A data package is not a passport. Forging one that survives authentication is a materially harder problem than buying a file, which is why document verification raises the cost of fullz-driven fraud so sharply.
It cannot pass a biometric check. No amount of biographical data supplies a live face matching the victim’s portrait. This is the single control fullz cannot be spent against.
It does not stay fresh. Addresses change, cards are reissued, passwords are rotated. Packages decay, which is why freshness drives pricing and why the same data resurfaces at falling prices for years.
It cannot be un-leaked. Once a package circulates, the victim cannot make their date of birth private again. That permanence is why controls resting on the secrecy of personal data are structurally unsound, not merely weak.
Frequently asked questions
What does fullz mean?
Criminal slang for a complete set of stolen personal information about one individual — name, date of birth, Social Security number, address, and often financial credentials. The term is shorthand for “full information,” and completeness is what distinguishes it from a stolen card number.
What is fullz used for?
Opening accounts in the victim’s name, taking over existing accounts, filing fraudulent tax returns, applying for loans, and supplying the real identifiers used to build synthetic identities. Anything requiring identity rather than just payment.
How much does fullz cost?
Prices vary with completeness, freshness and the victim’s credit profile. Packages including a driver’s license image or a strong credit score sell at a substantial premium because they open up lending rather than only spending.
How can businesses defend against fullz-driven fraud?
By not relying on knowledge of personal data as proof of identity. Document authentication paired with a biometric check asks for something a data package cannot supply — a genuine credential held by the matching live person.
Related reading
- Synthetic identity fraud — what the real identifiers inside fullz get used for
- Bank drop — where funds move once an account is opened
- Fraud ring — how purchased packages get monetized at scale
- Identity theft — the broader category fullz enables
