What Is Fullz?

Fullz, underground shorthand for "full information," is a complete package of stolen personal data about one victim, bundled and sold as a single fraud-ready unit rather than a lone data point. Where a bare stolen card number supports only carding against that one payment method, a fullz listing typically pairs name, date of birth, address, national ID or Social Security number, and financial account details into an identity coherent enough to pass verification checks designed to catch exactly this kind of fraud. The term names the product tier at the top of the stolen-data economy: not a fragment, but nearly everything a service needs to believe it is dealing with a real, specific person.

How fullz enter the market

Completeness is assembled, rarely stolen whole. Large-scale data breaches supply the bulk records; phishing and social engineering add details breaches miss; email scraping and social media reconnaissance layer in employer and context data that makes a profile more convincing. Brokers on underground forums and marketplaces then merge partial records from multiple sources into single listings, priced by completeness, victim geography, and freshness: a newly compromised identity commands more than one already flagged across the fraud-prevention industry's shared blocklists.

What fullz enable

A complete identity is the raw material for identity theft in its most damaging form: opening new lines of credit, filing fraudulent tax refunds, and passing the identity-verification steps that legitimate services use precisely to stop lower-quality fraud attempts. Fullz also feed synthetic account creation, where a real ID number anchors a fabricated identity built to survive scrutiny longer than a wholly invented one would. Buyers rarely use a single fullz listing by hand: the return on one identity is modest, so operations that purchase fullz in bulk pair them with automation, running them through account-opening and verification flows at a volume no manual fraud team could sustain.

Where the defense has to sit

Fullz make identity-based checks alone insufficient: the whole point of the product is that it passes them. The complementary layer is verifying that a human, not a script, is behind each attempt: bot detection such as CaptchaFox at registration and application endpoints does not know or need to know whether an identity is stolen, but it reliably catches the automation that turns one fullz listing into hundreds of attempted accounts. Removing that automation does not stop identity theft, but it collapses its economics: a fraud operation reduced to typing applications in by hand no longer scales.