Fullz and Identity Fraud on the Darknet — How Personal Data Is Traded and Used

The Dossier Trade: How Fullz and Identity Data Flow Through Darknet Markets

The trade in stolen personal data on darknet markets has long since evolved from the days of dumped credit card numbers in IRC channels. Today, it operates as a structured, tiered economy where raw financial data and complete identity packages-commonly referred to as “Fullz”-are bought, sold, and validated with industrial efficiency. For anyone tracking the underground data supply chain, the distinction between a simple dump and a Fullz package is the difference between a quick cash-out and a long-term identity takeover. Understanding how this data is acquired, packaged, priced, and ultimately used is essential for researchers, fraud analysts, and anyone serious about personal OPSEC.

Defining the Product: Dumps, Bases, and Fullz

The terminology on carding forums and darknet markets is precise. A “dump” typically refers to the raw data encoded on a credit or debit card’s magnetic stripe-track 1 and track 2 data-that can be written to a blank card for physical point-of-sale fraud. But the real value lies in what vendors call “Fullz.” As the Wikipedia entry on carding notes, “Full identity information may be sold as ‘Fullz’ inclusive of social security number, date of birth and address to perform more lucrative identity theft.” This is the complete package: name, Social Security number, date of birth, address, phone number, and often the associated financial account details. It is the data set required to open bank accounts, apply for loans, file fraudulent tax returns, or commit medical identity fraud.

Between these two extremes lies the “Base” or “First-hand base.” These terms indicate that the seller participated in the theft directly-via skimming, phishing, or hacking-rather than reselling data bought from another source. Resellers “may buy ‘packs’ of dumps from multiple sources,” aggregating data from different theft operations to offer larger, more diverse inventories. This layering of supply makes attribution difficult for law enforcement and means that a single Fullz package might contain data from three different breaches.

Acquisition Methods: From Skimmers to BIN Attacks

The methods for acquiring this data are as varied as they are persistent. Physical skimming at ATMs and gas pumps remains a staple, but the scale of digital theft has dwarfed physical methods. Hackers compromise e-commerce sites via web skimming (injecting JavaScript that captures payment forms in real time) or breach payment processors directly. The Wikipedia article on carding outlines a particularly elegant technique: “Carders might attempt a ‘distributed guessing attack’ to discover valid numbers by submitting numbers across a high number of ecommerce sites simultaneously.” This is a BIN (Bank Identification Number) attack, where the first six digits of a card are known, and the remaining digits are brute-forced across dozens of merchant sites. The system validates the card without completing a purchase, and the carder collects the confirmed numbers.

Social engineering still works, too. “Randomly calling hotel room phones asking guests to ‘confirm’ credit card details” is a low-tech but surprisingly effective vector. More sophisticated operators target corporate HR databases for W-2 data, yielding Fullz on entire employee populations. The common thread is that the data is often fresh, and freshness drives price.

The Darknet Marketplace as a Full-Service Economy

These stolen goods are not sold on generic, ad-hoc forums. They are marketed on what the Wikipedia entry describes as “full-service commercial entities.” Modern darknet markets, accessed via Tor or I2P, provide escrow services, vendor feedback systems, and dispute resolution. The ecosystem mimics legitimate e-commerce. Buyers browse by country and zip code to avoid alerting banks-a seller might advertise “Dumps USA – California – 50qty – High ValRate.” Sellers prominently display their “valid rate,” the percentage of cards that still work at the time of sale, typically estimated from automated checker services that test cards against small, low-risk transactions. “Cards with a greater than 90% valid rate command higher prices.”

Trust is a fragile commodity in this space. “Fraudulent vendors are referred to as ‘rippers,’ vendors who take buyer’s money then never deliver.” The feedback systems and escrow mechanisms that evolved after Silk Road’s model are designed precisely to mitigate this. A vendor who consistently delivers fresh, validated Fullz builds a reputation that commands premium prices. Conversely, a single exit scam can destroy a vendor’s handle overnight.

Validation and Automated Checkers

Before a buyer spends hundreds of dollars on a bulk package of Fullz, the data must be verified. Dedicated checker services exist for exactly this purpose. These are automated bots that submit the stolen card numbers to low-risk, non-suspicious merchant sites-charitable donations, small digital goods-to confirm the card is still active and has available credit. The seller will often include a sample of the batch’s “cobs” (changes of billing), where enough information was captured to redirect the card’s mailing address to one under the carder’s control. This is critical: a “cob” allows a carder to receive physical goods shipped to a mule’s address without the bank’s fraud detection triggering an immediate decline.

From Data to Cash: The Cashing-Out Pipeline

The endgame for most buyers of Fullz is monetization. The simplest path is to “cash out” via buying pre-paid cards or gift cards, which are then used to purchase high-value goods like electronics or luxury items. These goods are often sent to “mules”-individuals who accept packages and reship them, often unwittingly. The goods then surface on legitimate e-commerce platforms like eBay in a process called e-fencing.

But identity theft using Fullz goes deeper. With a Social Security number, date of birth, and address, an actor can apply for credit cards, loans, or even government benefits in the victim’s name. In the most devastating cases, as seen with pig butchering scams tracked by TRM Labs and the DOJ, the proceeds from stolen identities are commingled with funds from romance scams and investment fraud. A single wallet can contain “commingled funds from numerous victims.” The FBI’s Cleveland Field Office recently seized $8.2 million from such a scheme, using dual legal theories to forfeit both directly traceable fraud proceeds and funds linked to money laundering. This illustrates how identity fraud fuels broader financial crime networks, and why tracing the data back to its source is so difficult.

The Bitcoin Myth and the Shift to Monero

For years, the common wisdom among darknet users was that Bitcoin was anonymous. That myth has been thoroughly debunked. As the OPSEC guides repeatedly stress, “Every single Bitcoin transaction is recorded on a public ledger called the blockchain.” If a buyer on a carding forum pays with Bitcoin purchased from a regulated exchange, investigators simply follow the transaction trail backward from the marketplace wallet to the exchange, where KYC data ties the wallet to a real identity. The fix is Monero (XMR), a privacy coin that obfuscates sender, receiver, and amount. Serious identity fraud actors now demand Monero for Fullz transactions, and markets that fail to support it see declining vendor trust.

OPSEC for the Researcher: What Not to Do

Anyone researching these markets from a security or intelligence perspective must treat their own operational security with the same rigor as the criminals they study. The most common mistake is browser fingerprinting. “JavaScript is a massive security vulnerability,” and the Tor Browser’s warning against maximizing the window is not paranoia-it is an anti-fingerprinting measure that distinguishes your browser from the thousands of other Tor users. More critically, investigators must compartmentalize their personas. “If your anonymous dark web handle is tied to an old Yahoo email address you used in 2012, your identity is instantly compromised.” A dedicated, never-outside-Tor ProtonMail account, a unique username system, and a separate set of passwords for every marketplace are baseline requirements. And never, ever use your personal device’s browser to directly visit a marketplace that serves JavaScript without first checking the URL against a trustworthy mirror list-exit scams have claimed more than a few curious researchers who clicked a bad link.

The Data Broker Loophole and the Legal Gray Zone

Some of the most valuable Fullz packages are not stolen through hacking but through legal data broker aggregation. As the OSINT investigator’s guide notes, “Data broker companies constantly scrape public social media profiles, package your age, address, family members, and phone numbers, and sell them to anyone with a credit card.” A darknet vendor can buy this legally scraped data from a broker, then sell it as a “verified” Fullz package-with the seller’s SSN added from a separate breach-and claim it as a “first-hand base.” This blurring of legal and illegal data streams makes it nearly impossible to distinguish between a victim of a breach and someone whose public profiles were simply scraped and re-packaged. The market for identity data is so mature that the same individual can have their data sold both legally and illegally within the same week.

Conclusion: The Persistent Threat and the Researcher’s Role

The trade in Fullz and identity data on darknet markets is not going away. It is a mature, resilient economy that adapts quickly to law enforcement actions. The tools and methods documented here-from BIN attacks and automated checkers to escrow-based marketplaces and Monero transactions-represent the current state of the art. For researchers, the value lies not just in tracking the data but in understanding the full pipeline from acquisition to monetization. That knowledge enables better detection, faster takedowns, and, ultimately, more effective protection for potential victims. The data is already out there; the only questions are who will use it and how soon the next run of fresh Fullz hits the market.