In the dark corners of the internet, your identity isn't just a name—it's a product. Cybercriminals have a specific term for a complete dossier of your personal life: Fullz.
Understanding what these are and how they are used is the first step in building a digital "immune system" to protect your finances and reputation.
1. What Exactly are "Fullz"?
The term Fullz is slang used by hackers and "carders" (credit card fraudsters) to describe a full set of personally identifiable information (PII). Unlike a simple list of leaked emails or just a credit card number, Fullz contain everything a criminal needs to successfully impersonate you.
A typical Fullz package includes:
- Core Identity: Full name, date of birth, and Social Security Number (SSN).
- Contact Info: Physical address (current and previous), phone numbers, and email addresses.
- Financial Data: Bank account numbers, routing numbers, and credit/debit card details (including CVV and expiration dates).
- Security Details: Maiden names, passwords, and answers to common security questions.
Why are they so valuable? A single credit card number might sell for $1–$5 on the dark web because it can be easily cancelled. A "Fullz" package is much more valuable—often fetching $30 to $100+—because it allows for long-term fraud that is much harder for the victim to stop.
2. How Scammers Use Fullz
Once a criminal purchases your Fullz, they use the data for "high-stakes" fraud:
- New Account Fraud: Applying for new credit cards, personal loans, or even mortgages. With an SSN and address history, they pass credit checks easily.
- Account Takeover (ATO): Scammers use security answers to bypass bank authentication and change recovery details, locking you out of your accounts.
- Tax Refund Fraud: Filing fraudulent tax returns early in the year to steal your refund before you file.
- Synthetic Identity Theft: Mixing your real SSN with a fake name to create a "ghost" identity that builds credit before "busting out" with massive debt.
3. How Scammers Get This Data
Fullz are usually the result of data aggregation. Scammers piece the puzzle together using:
- Corporate Data Breaches: Large-scale hacks provide the "base" data.
- Phishing & Smishing: "Urgent" emails or texts designed to make you volunteer missing pieces (like a PIN or SSN).
- Social Media Scraping: Automated tools pull hometowns, birthdays, and family names from public profiles to answer security questions.
4. How to Not Be a Victim
You cannot always prevent a breach, but you can make your data useless to a scammer.
The "Big Three" Protections
| Action | Why it Works |
|---|---|
| Freeze Your Credit | Prevents lenders from pulling your report, stopping new accounts from being opened. |
| Password Manager + 2FA | Ensures a breach at one site doesn't compromise your bank. Use Authenticator apps over SMS. |
| Audit Social Privacy | Prevents automated scraping. Stop sharing "first car" or "mother's maiden name" details. |
The "Red Flag" Habit
Check your credit report once a month. If you see an inquiry from a bank you don't use, someone may be testing your data.
Bottom Line: Scammers look for the path of least resistance. By freezing your credit and securing your accounts, you make your data "too much work" to exploit, forcing the hacker to move on to an easier target.
