A fullz is a complete stolen identity profile sold as a single package on underground markets, giving the buyer enough information to impersonate the victim across financial, government, and digital systems. The word is criminal slang for “full information,” and the appeal is bundling: each piece of data reinforces the others, letting a buyer clear verification hurdles that would stop someone holding only a loose password or a single stolen card number.
The Biographical Core
Every fullz starts with the information that anchors a person’s legal and financial identity: full legal name, Social Security number, date of birth, and current and previous residential addresses. These four data points are not random. Federal regulations implementing the USA PATRIOT Act require financial institutions to verify a customer’s name, date of birth, address, and taxpayer identification number before opening any account, so a buyer who has all four can walk through the front door of the verification process.1National Credit Union Administration. Examiner’s Guide – Customer or Member Identification Program
The Social Security number is the single most valuable element because it unlocks the victim’s credit file. With it, a criminal can open new credit accounts, file fraudulent tax returns, or apply for government benefits in the victim’s name.
Previous addresses matter more than people assume. Banks and lenders often ask “out-of-wallet” security questions drawn from address history, and a fraudster who can recite where you lived in 2019 breezes through those challenges. That depth of data is what separates a fullz from a simple credit card dump. The buyer gets long-term control over the identity rather than a single transaction.
Financial Logins and Email Access
Premium bundles go well beyond biography. They typically include credit and debit card numbers with expiration dates and verification codes, allowing immediate purchases. More valuable still are login credentials for checking and savings accounts, usually harvested through phishing emails or malware installed on the victim’s computer. With those credentials, a criminal can initiate transfers or drain accounts within minutes.
Email access is often the most consequential piece in the bundle. Most banks and brokerages rely on email for password resets and two-factor authentication codes. Once a criminal controls the inbox, they can intercept security alerts, approve their own login attempts, and lock the real owner out. Many victims only realize someone has been reading their email for weeks when a large transfer clears.
Federal consumer protections do limit your liability for unauthorized electronic transfers, but only if you act quickly. Under Regulation E, you must report unauthorized transactions appearing on a bank statement within 60 days of receiving it or risk being on the hook for losses the bank can show it would have prevented with earlier notice.2eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section: 205.6 Liability of Consumer for Unauthorized Transfers
Medical and Insurance Data
Some bundles now include health insurance member IDs and medical record details, turning health care fraud into another revenue stream. A buyer can use stolen insurance credentials to fill prescriptions, receive treatment, or submit fraudulent claims. The danger goes beyond money. When someone else’s diagnoses, allergies, or blood type get mixed into your medical file, the result can be a dangerous treatment decision later.
Warning signs include bills for services you never received, explanation-of-benefits statements listing unfamiliar providers, and claims that hit your deductible before you’ve seen a doctor. If an insurer denies coverage because your benefits are supposedly exhausted, someone else may be using your policy.
Device Fingerprints and Session Tokens
Modern fraud detection does not just check passwords. It analyzes the hardware and software signature of the device logging in: browser type, operating system, screen resolution, IP address, and the time zone the computer reports. High-end fullz bundles include this technical metadata harvested from the victim’s machine, so the buyer can mimic the victim’s device down to the pixel.
The most sophisticated packages include session cookies and authentication tokens pulled from the victim’s browser. Imported into a specialized anti-detect browser, these let a criminal skip the login screen entirely, because the server sees what looks like an already-authenticated session from a familiar device. This technique defeats systems that rely on device fingerprinting to spot unfamiliar logins.
Law enforcement has moved against the platforms that supply this data. The FBI’s April 2023 takedown of Genesis Market disrupted a marketplace that had offered data stolen from over 1.5 million compromised computers worldwide, containing more than 80 million account credentials.3United States Department of Justice. Criminal Marketplace Disrupted in International Cyber Operation
How Fullz Are Priced and Sold
Fullz are listed on encrypted forums and dark web marketplaces with the polish of a legitimate e-commerce site. Listings advertise selling points like the victim’s estimated credit score, account balances, or country of residence. Categories are searchable, reviews are posted, and sellers compete on data quality the way any vendor competes on product ratings.
Pricing hinges on freshness and completeness. A basic set of biographical data with no account access might sell for under $20. Add bank login credentials and the price climbs into the hundreds. Bundles that include device fingerprints, email access, and high-limit credit accounts command the highest premiums. Sellers often offer replacement guarantees: if the SSN comes back flagged as deceased or the bank accounts have already been closed, the buyer gets a new profile. Transactions almost always run through cryptocurrency to keep both sides anonymous.
Children Are a Prime Target
Children’s Social Security numbers are especially attractive to fullz sellers because they come with a clean credit history, and the fraud often goes undetected for years. A child typically has no reason to check their credit until they apply for student loans or a first credit card, giving a criminal a decade or more of uninterrupted use.
Warning signs tend to surface at awkward moments. You might be denied government benefits because someone is already collecting them under your child’s SSN, or the IRS might send a letter about unpaid income taxes tied to a job your child never held.4Federal Trade Commission. How To Protect Your Child From Identity Theft
Parents and guardians can freeze a child’s credit at all three major bureaus for free if the child is under 16. The freeze stays in place until you ask for it to be removed and blocks anyone from opening new credit in the child’s name. Each bureau has its own process and documentation requirements, so expect to submit proof of your relationship to the child separately to Equifax, Experian, and TransUnion.5Federal Trade Commission. Credit Freezes and Fraud Alerts
What to Do If Your Information Is in a Fullz Bundle
Speed matters more than perfection. The first move is freezing your credit at all three bureaus. A freeze is free, lasts until you lift it, and blocks anyone from opening new accounts in your name. You will need to contact Equifax, Experian, and TransUnion individually, but the process takes only a few minutes per bureau online or by phone.5Federal Trade Commission. Credit Freezes and Fraud Alerts
Next, lock down your Social Security record. You can request that the Social Security Administration block all electronic access to your account by calling 1-800-772-1213. Once the block is in place, nobody, including you, can view or change your information online or through the automated phone system. You will need to call back and verify your identity to remove the block later.6Social Security Administration. How You Can Help Us Protect Your Social Security Number and Keep Your Information Safe
To prevent fraudulent tax filings, request an Identity Protection PIN from the IRS. Anyone with an SSN or ITIN can enroll. The fastest method is through your IRS online account. If you cannot verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can submit Form 15227 and the IRS will call to verify your identity. The PIN is a six-digit number that changes annually, and any tax return filed without it will be rejected or delayed.7Internal Revenue Service. Get an Identity Protection PIN
If your SSN has already been used for employment you did not authorize, file IRS Form 14039, the Identity Theft Affidavit. You can submit it online, by fax to 855-807-5720, or by mail. If you are unable to e-file your return because your SSN was already used on someone else’s filing, attach the completed Form 14039 to the back of your paper return.8Internal Revenue Service. Identity Theft Affidavit (Form 14039)
File a report at IdentityTheft.gov, the FTC’s dedicated portal. It generates an official identity theft report, which entitles you to an extended fraud alert lasting seven years and helps when disputing fraudulent accounts with creditors who want documentation.5Federal Trade Commission. Credit Freezes and Fraud Alerts For the cybercrime side, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov with as much detail as possible: financial records, email addresses used by the criminals, and any websites or account numbers involved.9Internet Crime Complaint Center. IC3 Brochure If you receive correspondence about a passport application or renewal you did not initiate, contact the National Passport Information Center at 1-877-487-2778.10U.S. Department of State. Passport Fraud – DSS Crime Tips
Buying or Holding a Fullz Is a Federal Crime
Anyone tempted to think of a fullz as a curiosity purchase should know what they are picking up. Under federal law, unauthorized use or transfer of identity documents or stolen identification that yields $1,000 or more in a year carries up to 15 years in prison. If the identity theft is connected to drug trafficking or violent crime, the ceiling rises to 20 years, and terrorism-related identity fraud can bring up to 30.11Office of the Law Revision Counsel. United States Code Title 18 Section 1028 – Fraud and Related Activity in Connection With Identification Documents
Aggravated identity theft adds a mandatory two years in federal prison on top of whatever sentence the underlying crime brings, rising to five years when the theft is tied to terrorism. That add-on cannot run at the same time as the sentence for the underlying offense, so it always extends prison time. Mere possession of stolen identity documents or unauthorized access devices is itself a federal crime, so buying a fullz and never using it does not keep you safe.