A fullz bundle is a packaged set of stolen identity details that criminals use to impersonate a person and cause lasting harm.
Victims can face new credit, diverted refunds, and accounts they never opened, often long after the details left their control.
How it works
The bundle is dangerous because the pieces fit together well enough for a stranger to answer checks that a single leaked password cannot pass.
Harm shows up as loans, tax filings, medical bills, or store credit created in the victim's name without that person's knowledge.
Defenders should treat any discovery of such a bundle as a confirmed identity incident, not as a curiosity about criminal marketplaces.
Recovery means working with banks, credit agencies, and the person affected so new accounts can be frozen and the record corrected.
Concrete examples
- A person learns of three new credit cards only when collection letters arrive for purchases made in another city.
- A tax refund is redirected because a filing used a stolen government identifier and a matching name and address.
- A phone account is opened in a victim's name and then used to receive account recovery messages for other services.
Protective measures
- Place a fraud alert or credit freeze with the relevant credit agencies as soon as a victim reports this kind of bundle.
- Ask financial institutions to review recent account openings that used the affected name and identifiers.
- Help the person review bank, tax, and insurance records for activity they did not start.
- Do not store recovered bundles in open tickets, and limit who on your team can see the raw details.