What is fullz? How fraudsters use stolen identity packages and synthetic IDs to beat KYC in 2026, what they cost on the dark web, and how to stop the fraud.
Table of contents
- Fullz is fraudster slang for a complete stolen-identity package: a real person's name, address, date of birth and Social Security number, often with card or bank credentials and identity-document scans.
- Synthetic identity fraud stitches a real fragment, usually a genuine Social Security number, onto invented details to build a person with no single victim. The Federal Reserve called it the fastest-growing financial crime in its 2019 to 2020 white-paper series.
- Reported dark-web prices are low, not high: Comparitech's index put a basic fullz package at roughly 20 to 100 dollars, with United States records averaging about 8 dollars, on 2021 to 2023 data.
- Document-and-data-matching checks confirm that a record is consistent, not that a unique human exists, so a clean stolen package can pass standard onboarding.
- The uncomfortable supply chain: centralised identity-verification databases are themselves breached and resold. The IDMerit leak that Cybernews reported in November 2025 exposed the exact fields that make up a stolen-identity package.
Fullz is fraudster slang for a complete stolen-identity package, typically a victim's full name, address, date of birth and Social Security number, often with bank or card credentials and identity-document scans. Sold on dark-web markets for roughly 20 to 100 dollars, fullz feed account takeover, new-account fraud and synthetic identities stitched together to pass KYC checks.
TL;DR
This article is for fraud, risk and compliance teams at banks, fintechs, crypto exchanges and lenders who onboard customers and want to understand why clean stolen-identity packages pass standard KYC, and what actually shrinks the supply.
Fullz is a complete package of one real person's identity data, sold cheap on dark-web markets because breaches have flooded the supply. Criminals use these packages for account takeover, new-account fraud and, most damagingly, synthetic identities that blend a genuine Social Security number with invented details. Standard KYC checks confirm that the data matches, not that a real, unique human is applying, so a clean package passes. Detection helps but loses ground to AI-generated documents and selfies. The structural point this guide makes: the verification industry's own centralised identity databases are an upstream source of this stolen data, so the durable fix is to verify identity without warehousing the raw records that become the next breach.
What is fullz?
Fullz means "full information". It is carding-forum slang, born on the same fraud marketplaces that trade stolen card numbers, and although it is plural in form, sellers talk about buying "a fullz" as a single unit. One package is everything a criminal needs to impersonate a real person on paper. The richer the bundle, the higher the asking price.
What sits inside such a package usually includes:
- Full legal name, current and former addresses, and date of birth.
- Social Security number or another national identifier.
- Bank account or payment-card details, sometimes with the card verification value (CVV), the short security code printed on a payment card.
- Scans or photographs of a driving licence or passport.
- Occasionally email logins, phone numbers, or medical and employment records.
It is raw material. On its own a Social Security number is, in Comparitech's words, "not particularly useful". Bundled into a full package with a matching name, address and date of birth, it becomes a key that opens accounts. Our know your customer (KYC) glossary entry gives the bare definition of the check itself; this guide is the deeper map of how these packages move through the fraud economy and past identity verification.
How are fullz and synthetic identity fraud connected?
People conflate these two terms, so it helps to separate them cleanly. A fullz package is stolen data about a real person who exists and can, in principle, notice the theft. Synthetic identity fraud takes fragments, often a single genuine Social Security number drawn from such a package, and fuses them with a fabricated name, address or date of birth to manufacture a person who never existed. That hybrid earns its nickname: the Frankenstein identity.
The Federal Reserve's industry-recommended definition, published in its payments-fraud white-paper series across 2019 and 2020, frames synthetic identity fraud as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain". The stolen packages are the parts; the synthetic identity is the assembled body.
| Dimension | Fullz | Synthetic identity |
|---|---|---|
| Data source | Stolen data on a real person | Real fragment plus fabricated details |
| Does a victim exist? | Yes, one identifiable victim | No single victim; often a child's idle Social Security number |
| Typical fraud | Account takeover, instant card or loan fraud | Cultivated credit lines, then a planned bust-out (drawing every line to its limit at once, then vanishing) |
| Why detection is hard | Victim may notice and dispute | No one disputes; losses look like ordinary bad debt |
The practical link is the supply chain. The stolen packages are the wholesale input; synthetic identities are one of the products fraudsters build from them, and the one that does the quiet, long-running damage.
How do fraudsters use fullz to beat KYC?
Understanding how fraudsters use fullz to beat KYC means following the package through its full lifecycle. The chain is methodical, and each step is designed to look ordinary to an automated check.
- Acquire the package. A buyer purchases a stolen-identity bundle on a dark-web market, often selecting by country and credit profile.
- Test and validate. The fraudster checks which credentials are live, sometimes using small transactions or free-trial signups to confirm a card or login still works.
- Take over or open accounts. With clean, internally consistent data, the attacker either seizes the victim's existing accounts or opens new ones in their name, where name, address and identifier all match.
- Cultivate, for synthetic cases. When a synthetic identity is the goal, the fraudster nurtures it: opening a starter line, making on-time payments, and letting credit bureaus build a history around a person who is not real.
- Bust out. Once the cultivated identity holds meaningful credit, the fraudster draws every line to its limit and disappears. Because no genuine person complains, the lender often books the hit as a charge-off rather than fraud.
The Federal Reserve's white paper estimates synthetic identity fraud has cost United States lenders up to 6 billion dollars and accounts for 10 to 15 percent of charge-offs in a typical unsecured lending portfolio. That last figure is the tell: a large slice of what lenders write off as bad debt is, in fact, fraud they never recognised. To see the same chain from the attacker's seat, our decentralised KYC explainer walks through where document-centric checks let these applications through.
How much does fullz cost on the dark web?
Stolen-identity packages are cheap, and the reason matters more than the number. Comparitech's "Dark Web Prices" index, last updated in August 2023, reported a basic package, name, address, Social Security number and date of birth, selling for roughly 20 to 100 dollars. United States records averaged about 8 dollars each, while records from Japan, the United Arab Emirates and parts of Europe averaged closer to 25 dollars. These are reported ranges on 2021 to 2023 data, not a live 2026 quote, and prices drift as supply shifts.
| Item (reported, 2021 to 2023) | Typical price |
|---|---|
| Basic fullz package (name, address, SSN, DOB) | About 20 to 100 dollars |
| United States fullz record (average) | About 8 dollars |
| Card details with card verification value (CVV) | About 17 dollars |
| Physical cloned card | About 171 dollars |
The headline is the floor, not the ceiling. Prices are this low because the supply is enormous: every corporate breach restocks the shelves. Comparitech notes that a Social Security number alone is "not particularly useful", which is why complete packages command a premium over loose identifiers. When a single resource sells for the price of a sandwich, no amount of buyer-side friction will starve the market. That economics is the hinge for everything that follows in this guide.
Where do fullz come from?
Most stolen-identity packages do not come from picking one person's pocket. They come from corporate and institutional data breaches, including, uncomfortably, breaches at the identity-verification vendors that exist to fight fraud. Every database that stockpiles raw identity data is a future fullz supplier, and 2025 and 2026 produced a clear pattern of named incidents.
The strongest example is the IDMerit leak. On 11 November 2025, Cybernews researchers reported finding an unprotected MongoDB database, with no password, exposing roughly 1 billion identity records across 26 countries, including about 204 million in the United States, the single largest national share. Cybernews disclosed the find to IDMerit the same day, and the database was secured the next day, on 12 November 2025. The exposed fields, full names, addresses, dates of birth, national identifier numbers, phone numbers and email, are almost exactly the contents of one such package. IDMerit disputes the findings, stating that it does not store the underlying source data and that its own environment was not compromised. The dispute is worth stating plainly, but the shape of the exposure illustrates the risk that any centralised identity store carries.
It was not isolated. In January 2026, the verification vendor Sumsub disclosed an intrusion that began in July 2024 through a malicious attachment to a third-party support platform and went undetected for about 18 months; Sumsub says the exposure was primarily names, confined to a support environment, and that production verification systems were not affected. Separately, a breach disclosed in October 2025 and tied to the vendor 5CA exposed roughly 70,000 government-ID photos that Discord users had submitted for age-verification appeals, a figure NBC News confirmed; 5CA denied the data came from its infrastructure. Each company contests part of the framing, and that is fair to note. The pattern across all three is the lesson: the more raw identity data a vendor concentrates, the larger the target it becomes. We unpack the same dynamic in our analysis of why your KYC vendor is your biggest data-breach risk.
How did AI supercharge fullz and fake identities?
Generative AI changed the economics on the production side. A fraudster no longer needs to alter a stolen document; a model can generate a consistent utility bill, payslip, passport image or selfie in minutes. Because these artefacts are generated rather than tampered with, the forensic tells that document checks rely on, edited pixels, cloned fonts, mismatched compression, often are not present to find. The fake is internally clean from the first frame.
The selfie step is no safer. Deepfake video and injected camera feeds can defeat naive liveness checks that simply ask for a face on screen, which is why standards-grade verification matters more than a casual selfie prompt. A structural quirk compounds the problem: the Social Security Administration randomised how it issues Social Security numbers on 25 June 2011, removing the geographic and validation significance the first digits once carried. A side effect is that a number issued to a child cannot easily be validated against public patterns and stays untraceable until it is first used, which is exactly why synthetic-identity rings prize the Social Security numbers of minors. The fake-document problem connects directly to onboarding; our KYC for crypto exchanges guide covers the controls that AI-generated artefacts are designed to slip past.
Why is synthetic identity fraud so hard to detect?
The defining difficulty is the missing victim. With stolen-card fraud, a real person spots the charge and disputes it, which lights up the fraud signal. A synthetic identity has no one to raise a hand. The "person" pays on time for months, looks like a model customer, then vanishes, and the lender records the loss as a charge-off. Fraud that never gets labelled as fraud cannot be measured, modelled or stopped at the speed it spreads, which is a large part of why the Federal Reserve called synthetic identity fraud the fastest-growing financial crime in its 2019 to 2020 white-paper series.
The scale of identity crime overall is not in doubt. The Federal Trade Commission's Consumer Sentinel Network Data Book for 2024, released in March 2025, logged more than 1.1 million identity-theft reports and 12.5 billion dollars in reported fraud losses, a 25 percent rise on 2023. Against that volume, a document check and a selfie answer the wrong question. They test whether the artefacts look authentic, not whether the human behind them is real and unique. When the artefacts are AI-generated and the Social Security number is a genuine but idle one belonging to a child, both checks can pass while no real applicant exists.
How can you detect and prevent synthetic identity fraud?
There is a real defensive toolkit, and serious teams should run it. The honest framing is that each control catches data mismatches but none of them, on its own, proves a real, unique human is applying. That gap is the original asset of this guide: a defence checklist that states what each control does and does not catch.
| Control | What it catches | What it does not catch |
|---|---|---|
| SSN-to-name-to-DOB consistency checks | Crude mismatches and recycled fragments | A clean, internally consistent fullz |
| eCBSV Social Security number verification | A name, DOB and SSN that do not match SSA records | A real SSN paired with fabricated details and consent abuse |
| Device and velocity signals | Bulk applications from one device or burst patterns | A patient fraudster cultivating one identity slowly |
| Consortium and shared-data signals | Identities already flagged across members | A brand-new synthetic with no prior footprint |
| Behavioural analytics | Bot-like or anomalous session behaviour | A careful human operator behaving normally |
| Perpetual or ongoing KYC | Risk that emerges after onboarding | The core question of whether the applicant is one real person |
| Verify without centrally storing PII | Removes the honeypot that supplies future fullz | Not a fraud score; a structural change to the data you hold |
Download: the synthetic identity fraud defence checklist (PDF) is a one-page, print-ready version of this control map that you can keep beside your onboarding rules and share with fraud and risk teams.
Two practical points. First, eCBSV, the Social Security Administration's electronic Consent Based Social Security Number Verification service, returns only a yes or no on whether a name, date of birth and Social Security number match its records, and it requires the number holder's consent, so it narrows synthetic attacks but does not end them. Second, the last row is the contrarian move: detection alone is an arms race against AI-generated documents, and the only way to stop adding fuel is to stop creating the centralised stores that get breached and resold. Our decentralised KYC explainer and the KYC software page show how verification can run without that store.
Do centralised PII honeypots fuel the fullz economy?
This is the part most explainers skip, and it deserves a steelman of the other side first. The case for centralised identity databases is real: consortium data sharing really does catch synthetics that no single firm would see alone, and a well-run, encrypted store passes audits every day. Pooling identity data does make some fraud easier to spot. That benefit is true.
The cost is that the same pooled databases are an upstream source of the stolen packages that fraud teams then spend their budget fighting. The IDMerit exposure that Cybernews reported, contested as it is, leaked the precise fields that constitute a fullz record, at a vendor whose business is verifying identity. Every copy of a raw identity record is a copy that can be stolen, and the verification industry holds many of the largest copies. Detection sits downstream of a supply problem the industry partly creates.
The structural fix is to verify identity without becoming the place it accumulates. Privacy-first architecture shards verified data across a decentralised network of more than 60,000 nodes under a 29-of-100 threshold scheme, so no single node holds a complete record and there is no central honeypot to breach. The customer holds the key; there is no master key. A reusable credential, a KYC passport, lets a person verify once and re-present elsewhere, so fewer copies of raw data exist to steal in the first place. The identity check still happens; the standing target does not. The eIDAS-2 wallet direction points the same way, as our eIDAS 2 and KYC guide sets out. To map this to your own onboarding, see how it works or the KYC software page, and weigh the data you hold against the breach you would have to disclose.
The bottom line
Stolen-identity packages are cheap, AI makes the documents convincing, and synthetic identities hide inside ordinary bad-debt numbers. Each fact on its own is manageable; together they describe a fraud economy that back-end detection cannot win alone. The piece most explainers miss is that the identity-verification industry is both defender and supplier: every centralised store of raw identity data is a breach in waiting that restocks the dark web. Run the detection toolkit, by all means, but the move that actually shrinks the supply is to verify real, unique humans without warehousing the data that becomes the next fullz. Architecture, not more matching, breaks the chain.
Related resources
- Decentralised KYC: what it is and how it works
- Why your KYC vendor is your biggest data-breach risk
- KYC for crypto exchanges: compliant onboarding
- eIDAS 2 and KYC: the EU digital identity wallet
- Zyphe KYC software
- How Zyphe works
Cited sources
- Federal Reserve, press release on synthetic identity fraud and the industry-recommended definition
- Federal Reserve, synthetic identity payments-fraud white paper (cost and charge-off figures)
- Social Security Administration, SSN randomization (25 June 2011)
- Social Security Administration, electronic Consent Based Social Security Number Verification (eCBSV)
- Federal Trade Commission, Consumer Sentinel Network Data Book 2024
- Cybernews, global identity data leak exposes roughly 1 billion records (IDMerit disputes the findings)
- Comparitech, Dark Web Prices index (fullz and card pricing, 2021 to 2023 data)
- NBC News, 70,000 government-ID photos exposed in Discord-linked vendor breach
Michelangelo Frigo(Co-Founder at Zyphe)Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.