Fullz

What Does Fullz Mean?

Fullz is slang from the stolen-data trade for a “full” set of personal data on one real person. The CyberWire glossary calls it a carders’ term for a package that usually holds a name, a Social Security number or its local equivalent, a birth date and account numbers. Wiktionary lists it as a plural-only word built from “full” and the slang plural ending -z, and compares it with “dox”, another slang respelling.

What sets fullz apart from other stolen data is that the pieces are joined. A leaked email address or a card number is one fact, while a fullz record ties the facts about one identity together. With it, a buyer can answer the questions a bank, a phone carrier or a tax office asks to check who someone is.

FinCEN, the US financial intelligence unit, describes the same harm without the slang. Its January 2024 study of identity-related Bank Secrecy Act reports says criminals who “compromise the full PII details of victims” use them to open new accounts and loans.

What Is Inside a Fullz Record?

There is no fixed format: each seller decides what “full” means, and the saved ads in the fraud chapter of our Cybercrime Report 2026 list different parts. The table groups the fields named in public definitions and in those ads, with what each one lets a fraudster try.

Sellers also tag fullz with labels, such as a country (UK, or US and other countries), an age band (50+) or “dead”. In the ads we catalogued, a label is the seller’s own word, and the ads did not prove what any label means.

Two points matter for defenders. First, a listing is only a claim, and no identity ad in our catalogue proved that a record was real, current or about one single person.

Second, sellers price the parts separately. A menu dated 3 March 2026 asked $10 for a document scan, $15 for a scan with a selfie and $20 for a proof of address. The same menu had a fullz line at $7 to $25, and it did not say which dollar it meant.

How Are Fullz Different From Dumps, CVVs and Stealer Logs?

Stolen-data ads use several product names side by side. They hold different data, come from different places and call for different controls, so it helps to keep them apart.

The card definitions follow Group-IB’s explainer on card shops. The lines blur in real menus. In our research on stolen card ads, a 9 July menu mixed card and identity material, and a 15 June menu sold dumps with or without a PIN.

So read the fields a listing names, not its label. Our carding forums explainer covers the card trade. The stealer logs entry and our combolist explainer cover stolen logins.

Where Do Fullz Come From?

A record can come from one large leak or be put together from several. These routes appear in public reporting and in our own data:

• Data breaches. A data breach at a company that holds identity numbers and bank details can expose a whole set at once.
• Phishing. Phishing pages can ask for card and personal details as well as a password. The phishing ads in our fraud research name card information and session material among their access goals.
• Infostealer malware. An infostealer copies the names, addresses and phone numbers a browser remembers for forms, along with passwords and card data.
• Paid lookups. Some sellers fill gaps on demand. An ad dated 2 April 2026 offered Social Security number and date of birth lookups at $2 to $4, or $6 for a manual search.
• Insiders. FinCEN lists “abuse of access”, where trusted staff or providers misuse their authorized access to data, among the identity-related patterns in its reports.

How Are Fullz Sold?

Fullz are advertised in Telegram channels, on underground forums and in shops. Brandefense Blackhole, our cybercrime database, keeps the saved posts behind the fraud chapter of our Cybercrime Report 2026. For 1 January to 27 October 2026, the saved query for the word “fullz” holds 5,903 distinct posts, and 4,430 of them passed the report’s first filters.

Treat those numbers as a measure of how often the word appears, not of the market. Busy weeks were sampled rather than read in full, and a keyword match also catches requests, discussion and repeated ads. The saved collection leans on Telegram, with limited forum coverage. The fraud data method page sets out these limits.

Our study of identity fraud offers reads these ads field by field and shows which claims no ad proved.

The ads themselves follow a few patterns. Across the six catalogued ads that price fullz:

• Single records and bulk tiers. Most sell per package, and one June 2026 menu sold files in five tiers, from 50 to 2,000.
• Stock labels. Sellers mark records “checked” or “unchecked”, tag cheap stock “dead” and charge more for some country or age labels.
• After-sale terms. Ads promise to replace records that fail, offer escrow, and take bitcoin or USDT even when the price is set in pounds.

For how these venues work, see our guide to hacker and leak forums, the underground forum entry and our explainer on criminal Telegram channels.

How Much Do Fullz Cost?

Prices on explainer pages often come without a date or a source. The figures below are asking prices from saved ads in our fraud offer catalogue, each with its date, currency and unit. None is a completed sale, and nothing was bought or tested.

Three readings hold up. First, a single package cost between £3 and £35 in the ads that set their prices in pounds.

Second, bulk cuts the price per item. In the June menu it falls from £2 a file at 50 files to 60p at 2,000. In the March menu it falls from USD 20 to USD 7.50 a package.

Third, labels move the price. In the January menu, UK stock cost £5 more than US or other stock. Stock labelled “dead” cost £3, a tenth or less of the other two.

What the table cannot give is a share of fullz by country. Four of the six ads priced in pounds and one listed a national insurance number, but the catalogue picked ads for variety, not as a sample. A country label is also the seller’s word, not proof of where the victims live.

The asking price is far below the harm. FinCEN counted more than 222,000 Bank Secrecy Act reports that documented identity theft in 2021, together describing $36 billion in suspicious activity. A record sold for a few pounds can back a credit application worth far more.

What Do Criminals Do With Fullz?

A fullz record is a tool for passing the identity checks that banks, carriers and agencies rely on. These are the main uses:

• New account fraud. Opening cards, loans and bank or payment accounts in the victim’s name. FinCEN’s identity theft pattern describes attackers using a real person’s details to open accounts and apply for credit.
• Account takeover. Answering a call center’s or a recovery form’s questions with the record’s details, then changing the phone number or email. Our account takeover entry covers what follows.
• SIM swapping. Using personal details to get a mobile carrier to move the victim’s number, so one-time codes reach the criminal. See SIM swapping.
• Synthetic identities. The Federal Reserve defines synthetic identity fraud as using a combination of personal data to fabricate a person or entity. Real fields from a fullz record can be mixed with invented ones.
• Tax and benefit fraud. The IRS issues an Identity Protection PIN to stop someone else filing a tax return with your Social Security number. FinCEN cites false or inconsistent personal data in claims for COVID-19 and other government benefits.
• Targeted scams. Personal details make a phishing email or a vishing call more believable.

Victims who cannot notice the fraud are a known target. FinCEN notes that banks often spot identity theft only after finding that the person named was deceased, incapacitated or in prison when the application was made.

What Should a Fraud Team Do When Customer Fullz Appear?

A listing that matches your customers is an early warning, not proof of a breach. Work through it in this order:

1. Do not buy to check. Work from what the listing shows and from your own data. Paying a seller funds the trade, and holding stolen personal data raises legal questions for your counsel.
2. Record the sighting. Note the date, venue type, fields claimed, number of records claimed, price with currency and unit, and seller terms. The record sheet at the end of this page gives a format.
3. Find the common source. Look for the one system, partner or process that holds that exact mix of fields. If the mix points to you, start your incident process; our data breach response guide covers the first days.
4. Stop trusting what the record answers. Treat date of birth, address and ID numbers as known to the attacker for these customers. NIST’s 2025 identity guidelines, SP 800-63A-4, say knowledge-based verification shall not be used for identity verification.
5. Guard the change points. For the affected accounts, add a step-up check to any change of phone number, email, postal address or payee, and to sign-ins from new devices.
6. Watch the front door. The same identities may come back as new applications. Flag applications that reuse an exposed identity with a new phone number, email or device.
7. Tell the people affected what to do. Give them the steps in the next section. Your legal and privacy teams decide whether notification rules apply.

Expect the same records to come back, because sellers promise replacements and offers get reposted. Our study of repeated fraud posts found one recruitment pitch in 831 different texts.

What Can People Do if Their Fullz Are for Sale?

No one can pull a record off a market, but people can make it harder to use:

• In the US, place a credit freeze with each of the three credit bureaus, Equifax, Experian and TransUnion. USAGov says freezing and lifting it is free.
• Or place a fraud alert with any one bureau. The FTC says it lasts one year and can be renewed for free, and identity theft victims can get an extended alert for seven years.
• Get an IRS Identity Protection PIN, a six-digit number known only to you and the IRS. A new one is issued each year.
• In the UK, Cifas Protective Registration asks its members to make extra checks on applications in your name. It costs £30 for two years.
• In the US, IdentityTheft.gov gives step-by-step advice to report identity theft and fix your credit.

How Do You Hear About a Fullz Listing Early?

There are three usual signals: a spike in failed or odd identity checks, customers reporting accounts they never opened, and monitoring of the channels where records are sold. Only the last one can come before the fraud.

Whatever the source, record each sighting the same way, so you can compare it with the next one. This sheet follows the way our catalogue records each ad. The example values come from the 2 April 2026 ad.

Brandefense Dark Web Monitoring watches criminal forums, markets and stealer logs for your company’s data and tells you when a listing like this appears.