Fullz

Slang for a complete package of stolen identity details about one person.

Instead of a single stolen item, such as an email address, a full package gives a fraudster enough information to impersonate a specific person.

A bundle of personal data about one individual, typically including name, date of birth, address, government ID number, phone number, and email, sometimes with account or card details, sold on criminal marketplaces. The word comes from the phrase full information.

A package usually contains several kinds of detail:

• Identity basics, such as full name, date of birth, and address.
• Government identifiers, such as a national ID or social security number.
• Contact details, such as phone number and email address.
• Financial or security details, such as account information, or answers to common security questions.

The data usually reaches the market like this:

1. A data breach, phishing campaign, or malware infection exposes personal information.
2. Criminals combine details from several sources into complete records on individuals.
3. They sell the packages, often in bulk and often as part of a fraud-as-a-service marketplace.
4. Buyers use them to apply for credit, open accounts, or take over existing ones.

Fullz are used in several ways:

• Third-party fraud, where the buyer impersonates the victim to open accounts.
• Synthetic identity fraud, where the buyer mixes real details with invented ones.
• Account takeover, where the buyer uses details to pass security questions.

Fullz sit next to terms that are easy to mix up:

• PII (Personally Identifiable Information) is the general category of identifying information that fullz collect.
• Data breach is a common source of the underlying data.
• Third-party fraud is the use of a real person's identity without their knowledge, which fullz make easier.