Understanding Fullz: Identity Theft Data

[Anonymous]

Introduction: Beyond the Credit Card​

In our previous research, we focused heavily on financial tokens—credit card numbers, BIN codes, and magnetic stripes. But in the modern Carding forum ecosystem, a credit card number is considered a "low-tier" commodity.

Why? Because a card can be cancelled in seconds. A person's identity, however, is forever.

This brings us to the concept of "Fullz".

In cybersecurity slang, "Fullz" refers to a comprehensive dossier of a victim's Personally Identifiable Information (PII). Unlike a simple card breach, a "Fullz" leak allows a threat actor to assume the victim's identity completely.

For researchers and defense analysts, understanding the components of "Fullz" is critical. It helps us understand why Know Your Customer (KYC) protocols fail and why Synthetic Identity Fraud is the fastest-growing financial crime in 2025.

This thread acts as a supplementary chapter to our Complete Financial Tech Guide. If you are new here, please start there.

Let’s dissect the digital identity.

---

Section 1: The Anatomy of "Fullz" ​

What exactly distinguishes a "Card Dump" from "Fullz"? It comes down to the depth of the data points.

A standard credit card leak usually only contains the PAN (Primary Account Number) and an expiration date. "Fullz," however, contains the keys to the victim's financial life.

The Core Data Points​

To be classified as "Fullz" in underground research, a record must typically contain:

1. First & Last Name: The base identifier.
2. Date of Birth (DOB): Used as a primary security question.
3. Social Security Number (SSN): The "Skeleton Key" of US finance.
4. Current Address: Required for billing verification (AVS).
5. Phone Number: Used for porting attacks or SMS intercept.
6. Mother's Maiden Name (MMN): The classic legacy security question.

The "Pro" Level Data​

Advanced breaches, often originating from mortgage firms or healthcare providers, include even more granular data:

• DL Number: Driver's License number (and state).
• CR (Credit Report): The victim's credit score and history.
• Employment History: Used to apply for loans.

Defensive Context:
According to the FTC (Federal Trade Commission), the presence of an SSN in a data breach increases the risk of new account fraud by over 800% compared to a simple credit card breach. This is why notification laws are stricter when SSNs are involved.

---

Section 2: Fullz vs. BINs (The Distinction) ​

It is important to differentiate between the types of financial data we discuss.

In our last discussion on BIN Lists Explained, we looked at the mathematical structure of card numbers. That data is algorithmic.

Fullz are different:

• BINs relate to a Bank Account.
• Fullz relate to a Human Being.

You can change your card number. You cannot easily change your Date of Birth or SSN. This makes "Fullz" a static vulnerability. Once a person's data is leaked on the dark web, it remains dangerous for decades.

The Verizon Report:
The annual Verizon Data Breach Investigations Report (DBIR) consistently highlights that while payment card compromises are declining due to chip technology, Personal Data breaches are skyrocketing because that data is needed to bypass modern authentication.

---

Section 3: The Danger Vector (Synthetic Identity Fraud) ​

Why do criminals want this data? It's not just to buy a TV. It's to build a "Frankenstein Monster."

What is Synthetic Identity Fraud?​

This is a sophisticated technique where an attacker combines real data (like a child's SSN) with fake data (a made-up name and address).

1. The Mix: They use a real SSN (from the Fullz) but a different name.
2. The Application: They apply for a credit card.
3. The Rejection: The bank rejects it (because the name doesn't match), but this action creates a "Credit Profile" for that fake person in the credit bureau's system.
4. The Long Con: The attacker nurtures this fake identity for years, eventually busting out with massive loans.

Krebs on Security has documented cases where synthetic identities were cultivated for 5+ years before being "cashed out," costing banks millions. This is only possible because of the availability of "Fullz" to seed the initial profile.

---

Section 4: The Source of the Leak ​

Where do these "Fullz" come from? Unlike credit cards, they are rarely skimmed at a gas station.

1. The Corporate Database Breach​

This is the most common source. When a hospital, university, or background check company gets hacked, they lose the entire profile.

• Defensive Lesson: Organizations must practice "Data Minimization." Do not store SSNs unless absolutely legally required.

2. Phishing & Social Engineering​

Attackers set up fake landing pages (e.g., a fake IRS tax refund site). The victim voluntarily types in their Name, SSN, and DOB, thinking they are verifying their identity.

• Defensive Lesson: User education is key. No legitimate bank asks for your full SSN via email.

3. The "Insider Threat"​

A significant portion of "Fullz" appearing on the market comes from corrupt employees at telecom companies or car dealerships who screenshot customer applications.

CSO Online reports that insider threats are often harder to detect because the access to the data is legitimate; it is the intent that is malicious.

---

Section 5: The Defense (KYC and Document Verification) ​

So, how do we stop identity theft when everyone's SSN is already public?

The financial industry is moving away from "Knowledge-Based Authentication" (KBA).

• Old Way: "What is your Mother's Maiden Name?" (Useless, because it's in the Fullz).
• New Way: "Take a selfie and hold your Driver's License."

Document Verification (DocV)​

Modern Fintech apps (like Coinbase or Revolut) require you to scan a physical ID. AI then checks:

1. Holograms: Does the ID reflect light correctly?
2. Microprint: Is the font correct for that state?
3. Liveness: Is the selfie a real person or a photo of a screen?

However, even this is becoming a battleground. As noted by Infosecurity Magazine, "Deepfake" technology is now being used to fool liveness checks, creating a new arms race between AI generation and AI detection.

---

Section 6: Data Aging (Dead vs. Live) ​

Not all "Fullz" are equal. In forensic analysis, we look at the "Age" of the data.

• Fresh Fullz: Data breached within the last 30 days. High probability that the victim has not placed a credit freeze yet.
• Dead Fullz: Old data (years old). The victim has likely moved, changed phone numbers, or locked their credit.

The Credit Freeze:
The single most effective defense against Fullz abuse is the Credit Freeze. This locks the credit file at the bureau level (Equifax, Experian, TransUnion). Even if the attacker has every single data point perfectly correct, the bank cannot pull the credit report, and the loan is denied.

---

Conclusion: The Shift to Biometrics​

The existence of "Fullz" proves that Static Identifiers are dead.

We can no longer rely on a number (SSN) to prove who we are. In the near future, identity will be proven by Biometrics (FaceID, Fingerprint, Voice) and Behavior (Typing cadence, Location patterns).

For the researchers here: When you analyze a breach, look beyond the passwords. Look at the PII. That is where the long-term damage lies.

Discussion:
As security professionals, do you trust third-party identity providers (like ID.me or Clear) to hold your biometric data, or does aggregating that data just create a bigger "Honey Pot" for attackers?

Let’s debate the privacy implications below.