Bitcoin fullz and CVV sales are criminal marketplaces, not retail services. A "fullz" is a bundle of stolen identity records: legal name, address, date of birth, Social Security number, and account details. A "CVV" listing sells stolen card numbers paired with the three or four digit verification code. Sellers accept bitcoin because it crosses borders without a bank in the middle. Buying, selling, or using either one is illegal in the United States under identity theft, wire fraud, and access device statutes. There is no legitimate vendor in this space. Sites that claim to be one are usually running a scam against the buyer or operating as a law enforcement honeypot.
What Each Term Covers
Fullz
A fullz record is assembled from data breaches, phishing pages, call center insiders, and mail theft. The word signals that the record is complete enough to open a new account, file a fraudulent tax return, or pass a knowledge-based verification check. Records are often sorted by state, credit score range, or the issuer they came from.
CVV and Card Dumps
In these listings, CVV refers to the card verification value printed on the card itself. A "dump" is the magnetic stripe data pulled from a skimmer. Some sellers bundle the two so a buyer can use the number online and the stripe data at a terminal.
How the Trade Works
Transactions typically happen on darknet forums, encrypted messaging apps, or invite-only Telegram channels. Payment is made in bitcoin or another cryptocurrency, and the stolen data is delivered as a text file or a screenshot of a database. Escrow services are common in name only. Chargebacks do not exist, and a buyer who is cheated has no recourse because the underlying transaction is a crime.
Legal Exposure in the United States
Possessing stolen card data with intent to use it can be charged under 18 U.S.C. 1029, which carries prison time and fines. Aggravated identity theft adds a mandatory two-year sentence on top of the underlying offense. Purchasing the data with cryptocurrency does not create anonymity. Blockchain analysis firms trace wallet flows, and exchanges comply with subpoenas. Prosecutors routinely build cases from chat logs, wallet records, and seized devices.
If Your Information Shows Up for Sale
- Pull your credit reports from all three bureaus and read the account list for entries you did not open.
- Place a free credit freeze with each bureau so no new account can be opened in your name.
- File an identity theft report with the Federal Trade Commission and keep the report number.
- Report the listing to the FBI Internet Crime Complaint Center with screenshots and any seller handles you saw.
- Call your bank and each card issuer to close exposed accounts and request new numbers.
- Change passwords on every financial account and turn on two-factor authentication with an app rather than SMS.
Reducing Your Exposure
- Freeze your credit at all three bureaus when you are not actively applying for a loan.
- Use a password manager so a breach at one site does not unlock the others.
- Shred statements and pre-approved credit offers before they go in the trash.
- Review card statements line by line each month instead of scanning the total.
- Treat any unsolicited message asking for your card number, PIN, or one-time code as fraud.
The market exists because stolen records are cheap to resell and hard for victims to trace. Freezing your credit and reporting early are the two steps that limit the damage fastest.