What is Fullz?

This gets really expensive for merchants because of how the fraud actually works. Fraudsters who use fullz to make purchases can answer the security questions correctly and pass address verification checks without any problems. From your payment system’s perspective, they look just like legitimate customers who make normal purchases. Eventually the real cardholder sees the unauthorized charge on their statement and disputes it with their bank. At that point, you’re stuck with a chargeback and you’ve already lost the merchandise.

Fullz are especially dangerous for online businesses because of how thorough they are. Most fraud detection methods just don’t work when the criminal has access to all of the right answers. Check. Check. They even have the mother’s maiden name for the extra security questions. All of your standard verification processes can’t do much to protect you when a fraudster has access to the victim’s entire identity profile.

Criminals who use fullz usually go after high-value items that they can resell right away. A lot of them will ask for rush shipping to get the products delivered before anyone detects the fraud. These fraudsters know the timeline that they’re working with and how long it takes before the real account holder sees something suspicious on their statement.

How It Works

Criminals get their hands on fullz through a handful of methods that have become far too common. Data breaches at businesses and corporations can expose millions of customer records all at once. Phishing emails are designed to trick victims into handing over their personal information on fake websites that look like legitimate sites. Malware programs can quietly steal information from infected computers without anyone noticing. Skimming devices are installed on ATMs and gas pumps to grab card data when you swipe or insert your card.

Once fraudsters have this full identity package, they can create transactions that look legitimate to most payment systems. A fullz contains everything that’s needed to pass those first fraud checks that merchants use during transactions. The name, address, social security number and card info all match up exactly with what’s on file.

That’s where it becomes a problem for merchants who want to protect their businesses. Fraudsters can use fullz to take over existing customer accounts because they have all of the correct answers to security questions and verification prompts. They can also open brand new accounts that look genuine because all of the information checks out against standard verification procedures. Card-not-present fraud gets especially simple for criminals when they have all of the billing information that they need to bypass most standard verification systems.

These stolen identities get traded on markets where criminals buy and sell them just like any other product. Fresh fullz from recent data breaches usually cost more money because the victims haven’t noticed anything wrong with their accounts yet. The older data sells for less on these markets but still works well enough to be profitable for fraud operations.

Organized fraud rings actually run these operations with the efficiency and structure of a legitimate business.

How it Affects Chargeback Prevention

When criminals use fullz to make purchases they create a big problem for the merchants. The transactions actually look legitimate because the fraudster has all of the right information at their disposal. Everything passes the address verification and the CVV checks come back clean without any red flags at all.

The bigger problem shows up a few weeks or months later when the cardholder finally notices the charges on their statement. The merchandise is long gone by that point and the merchant is stuck with a chargeback that they probably can’t win. Most of these chargebacks fall under the reason codes related to unauthorized transactions or account takeover and they’re very hard to dispute because the merchant actually did follow the standard security protocols correctly.

The financial damage hits the merchants from a few different angles all at once. They first lose the product and the payment when the chargeback comes through. Then their chargeback ratio starts to climb and it triggers higher processing fees from their payment provider. If the ratio climbs too high they might lose their merchant account for permanently. Some businesses never actually recover from a big fullz fraud attack.

Most of the standard fraud prevention tools fail to catch fullz fraud because all of the basic checks pass. The billing address matches and the security code is correct. The fraudster might even use the victim’s phone number and email address to finish the verification process without any problems. Merchants need to spend money on better detection systems that can analyze behavior patterns and device fingerprints if they want to have any chance of prevention.

Example Scenarios

This fraud talk is abstract until it happens to a merchant. These scenarios play out all the time in online businesses and they can be pretty devastating.

Think about an online clothing retailer who just processed what looked like a normal order. The customer logged into an existing account (one that they supposedly used before) and ordered 3 expensive designer jackets. Everything seemed legitimate on the surface because the criminal had purchased the fullz data that included the customer’s email address and password from an earlier data breach. The account owner won’t know that anything is wrong for a few weeks until they finally check their credit card statement. By that time, the jackets are long gone and the merchant is left stuck with a chargeback and an angry customer who wants answers about how somebody accessed their account.

Criminals can get even more creative when they usesynthetic identity fraud. They’ll grab a Social Security number from the fullz data and mix it with a fake name and address. From there, they will open accounts with subscription box services or software businesses. They’ll pay their bills on time for months at a time, all to build up trust and legitimacy. Eventually they will make a few large purchases or max out whatever payment methods they have access to and then they just disappear.

Online merchants also run into problems with what’s called dead fullz. These are identity profiles from victims who have already found out about the fraud and reported it to their banks. Criminals know that the automated fraud detection systems at most of these places (music streaming services, cloud storage providers and platforms like that) don’t verify much past basic card authorization checks.

Requirements and Timeframes

When a criminal uses fullz to attack your business, you’ll have to act right away and the response time is everything. Most payment processors only give you 7 to 10 days to dispute a chargeback. It gets much harder to meet that deadline if you have to investigate to see if the transaction involved a stolen identity or not.

Data protection standards are in place to help stop your business from accidentally becoming a source of fullz data. All of the customer information that you store could end up in the wrong hands if you don’t have solid security measures in place. At a minimum, you’ll have to encrypt payment data and limit which employees can access the customer records.

Know Your Customer protocols have become a must if you want to catch fullz fraud before it happens. You want to verify that the person who is making the transaction is actually who they claim to be. Strong Customer Authentication can add some more protection by requiring multiple forms of proof during the checkout process. These extra steps create barriers that make fullz much less effective for criminals.

Fraud liability laws have changed quite a bit over the years. Skipping the security measures and accepting a fraudulent transaction means that your business is probably going to cover the cost. Even if you follow the protocols correctly, fullz can still get through because the stolen data looks legitimate. Real-time tracking helps you spot the patterns that humans might miss on their own. The sooner you can catch suspicious activity, the better your odds are of keeping the losses down.