How do I fill out the information?

After verifying that the card is active and that the name and billing address are correct, where can I find the missing information—SSN, mother's name, and date of birth?

polkadot222 said:

After verifying that the card is active and that the name and billing address are correct, where can I find the missing information—SSN, mother's name, and date of birth?View attachment 17737

Click to expand...

You will need to use lookup services

THE PII HUNT: FINDING SSN, MOTHER'S MAIDEN NAME, AND DOB FOR CARD ACCOUNT TAKEOVER​

From the desk of an carder with over a decade in the game

TABLE OF CONTENTS

• Introduction: The Form That Stops Most Carders Cold
• Part 1: Why This Form Exists — The ATO Defense Layer
• Part 2: The PII Triad — SSN, MMN, and DOB Explained
• Part 3: The Fullz Economy — Where These Data Sets Come From
• Part 4: Method #1 — Buying Fullz from Carding Markets
• Part 5: Method #2 — Data Breach Datasets
• Part 6: Method #3 — Social Engineering and OSINT
• Part 7: Method #4 — SSN+DOB+MMN Services
• Part 8: Comparison of All Methods
• Part 9: Common Mistakes and How to Fix Them
• Part 10: OPSEC Rules
• Part 11: Complete Checklist
• Part 12: Key Takeaways

INTRODUCTION: THE FORM THAT STOPS MOST CARDERS COLD​

Bro, you've got a card. It's live. The name matches. The billing address is correct. You've tested it with a micro-transaction and it clears. You're feeling good.

Then you hit the MyCardStatement security reset form. It asks for:

• Full Name on Card
• Card Expiration Date
• Billing Zip Code
• Social Security Number or Tax ID Last 4
• Mother's Maiden Name
• Date of Birth

You have the first three. You don't have the last three. And without them, this card is useless for account takeover.
This is the wall that separates carders who can actually monetize from those who just burn cards on CNP purchases. The PII (Personally Identifiable Information) triad — SSN, MMN, and DOB — is the key that unlocks account reset, address changes, and full control.
This manual breaks down every method for obtaining this information, with step-by-step instructions, market pricing, and the hard truths about what works in 2026.

PART 1: WHY THIS FORM EXISTS — THE ATO DEFENSE LAYER​

Banks know that card numbers, CVVs, and expiry dates are compromised constantly. Data breaches, skimmers, and carding forums leak this data by the millions. If the bank only verified card details, account takeover (ATO) would be trivial.
So they added a second layer: knowledge-based authentication (KBA). The SSN, MMN, and DOB are things that (in theory) only the real cardholder knows.
The reality: These data points are just as compromised as card numbers. A single data breach can expose all of them at once. And the carding market has built an entire economy around selling this information in bundles called "fullz."
According to academic research on carding monetization, 243,000 sets of names, addresses, dates of birth, MMNs, and SSNs were found in analyzed data breaches — enough to apply for credit cards at all 13 institutions offering this service.

PART 2: THE PII TRIAD — SSN, MMN, AND DOB EXPLAINED​

2.1. Social Security Number (SSN)​

The SSN is the primary identity anchor in the US. It's used for credit applications, tax filings, and identity verification. The last 4 digits are often sufficient for account verification.
Why banks ask for it: To verify you're the person associated with the account.
Why it's compromised: SSNs are exposed in data breaches, sold on dark web markets, and sometimes available through public records.

2.2. Mother's Maiden Name (MMN)​

This is a legacy authentication question that banks still use. It's considered "something you know" that isn't written on your ID.
Why banks ask for it: It's supposed to be a secret only the cardholder knows.
Why it's compromised: MMN is often exposed in the same data breaches as SSN and DOB. It's also frequently discoverable through social media, genealogy sites, and public records.
Important note: In consolidated billing scenarios, some systems allow the MMN field to be left blank. But for individual account resets, it's usually required.

2.3. Date of Birth (DOB)​

The DOB is another "something you know" factor. It's used for identity verification and age verification.
Why banks ask for it: To confirm you're the person associated with the account.
Why it's compromised: DOB is exposed in the same breaches as SSN and MMN. It's also often publicly available on social media and people-search sites.

PART 3: THE FULLZ ECONOMY — WHERE THESE DATA SETS COME FROM​

3.1. What Is a Fullz?​

A "fullz" is a complete set of personal information for a single individual. It typically includes:

• Full name
• Address
• Phone number
• SSN
• DOB
• Mother's Maiden Name
• Sometimes: email, driver's license number, bank account details

For carding purposes, a fullz with financial information (card numbers, CVVs, PINs) is the most valuable.

3.2. Market Pricing (2026)​

According to carding market research:

The key insight: You can buy a fullz for less than $50. If it lets you take over an account with a $5,000 balance, the ROI is enormous.

3.3. What's Included in a Fullz​

Based on court documents and carding market analysis, a fullz with financial information includes:

"Full Name, billing address, payment card number, expiration date, PIN number, SSN, DOB, Mother's Maiden Name, CVV2 (3-digit number on back of credit/payment card)."

Click to expand...

This is exactly what you need to fill out the MyCardStatement form.

PART 4: METHOD #1 — BUYING FULLZ FROM CARDING MARKETS​

4.1. Overview​

This is the most direct method. You buy a fullz from a vendor on an carding market, and it comes with all the PII you need.

4.2. Where to Buy​

4.3. Step-by-Step Process​

Step 1: Select a vendor.

• Look for vendors with positive feedback and a history of valid fullz.
• Avoid new vendors with no track record.

Step 2: Purchase the fullz.

• Pay with cryptocurrency (BTC, USDT) to maintain anonymity.
• Request a sample before buying in bulk if possible.

Step 3: Verify the data.

• Check the SSN against public records or validation services (if available).
• Check the DOB and MMN against social media or people-search sites.

Step 4: Use the data to reset the account.

• Enter the PII into the MyCardStatement form.
• If successful, you now have control of the account.

4.4. Risks​

• Invalid data: Not all fullz are accurate. Some vendors sell recycled or fabricated data.
• Scams: Some vendors take payment and disappear.
• Burn risk: If the fullz is already flagged (e.g., the victim has already reported fraud), the reset will fail.

PART 5: METHOD #2 — DATA BREACH DATASETS​

5.1. Overview​

Instead of buying a single fullz, you buy a dataset from a data breach. These datasets contain thousands or millions of records, and you extract the PII you need.

5.2. Where to Find Breach Datasets​

5.3. Step-by-Step Process​

Step 1: Acquire the dataset.

• Purchase from a trusted source or find a public leak.
• Verify the dataset contains the PII fields you need (SSN, DOB, MMN).

Step 2: Parse the data.

• Use a script or database tool to extract records.
• Match records to the card you're trying to reset.

Step 3: Cross-reference.

• If the dataset has partial data, cross-reference with other breaches or public records to fill in gaps.

Step 4: Use the data.

• Enter the PII into the reset form.

5.4. Risks​

• Data quality: Breach datasets can be noisy, with incomplete or outdated records.
• Size: Processing millions of records requires time and technical skill.

PART 6: METHOD #3 — SOCIAL ENGINEERING AND OSINT​

6.1. Overview​

If you can't buy the PII, you can sometimes find it through open-source intelligence (OSINT) or extract it through social engineering.

6.2. OSINT Sources​

6.3. Social Engineering Techniques​

6.4. Step-by-Step Process​

Step 1: Gather basic information.

• Start with the name and address from the card.
• Search people-search sites and social media.

Step 2: Build a profile.

• Find DOB from social media or public records.
• Find mother's name from social media, obituaries, or genealogy sites.

Step 3: Fill in the gaps.

• If SSN is missing, use a data breach or SSN+DOB+MMN service.
• If MMN is missing, search marriage records or ask through social engineering.

Step 4: Use the data.

• Enter the PII into the reset form.

6.5. Risks​

• Time-consuming: OSINT and social engineering take significant effort.
• Incomplete: You might not find all three data points.
• Detection: Social engineering attempts can alert the victim.

PART 7: METHOD #4 — SSN+DOB+MMN SERVICES​

7.1. Overview​

There are carding services that specifically sell SSN+DOB+MMN sets — the exact PII triad you need for account reset.

7.2. How These Services Work​

• You provide a name, address, or partial information.
• The service returns the matching SSN, DOB, and MMN.
• Pricing ranges from $4 to $17 per set.

7.3. Step-by-Step Process​

Step 1: Find a service.

• These are advertised on carding forums and Telegram channels.
• Look for providers with positive feedback.

Step 2: Submit your query.

• Provide the information you have (name, address, card number).
• Pay the fee.

Step 3: Receive the PII.

• The service returns the SSN, DOB, and MMN.

Step 4: Use the data.

• Enter the PII into the reset form.

7.4. Risks​

• Scams: Some services take payment and provide fake data.
• Accuracy: The data may be outdated or incorrect.
• Burn risk: If the PII is already flagged, the reset will fail.

PART 8: COMPARISON OF ALL METHODS​

The best approach: Start with a fullz or SSN+DOB+MMN service. If that fails, fall back to OSINT.

PART 9: COMMON MISTAKES AND HOW TO FIX THEM​

Mistake 1: Using Invalid Fullz​

Problem: The reset fails because the PII is wrong.
Fix: Verify the PII against multiple sources before using. Check SSN validity, cross-reference DOB.

Mistake 2: Not Verifying the Data Source​

Problem: You bought from a scammer and got fake data.
Fix: Use vendors with positive feedback. Request samples. Start with small purchases.

Mistake 3: Ignoring Account Lockout​

Problem: Too many failed reset attempts lock the account.
Fix: Only attempt the reset when you're confident in the PII. Don't guess.

Mistake 4: Using the Wrong MMN​

Problem: The MMN field is case-sensitive or requires exact formatting.
Fix: Try different variations (maiden name vs. married name, capitalization).

Mistake 5: Not Checking for Alerts​

Problem: The account is already flagged because the victim reported fraud.
Fix: Test the card with a small transaction first. If it declines, the account may be flagged.

PART 10: OPSEC RULES​

PART 11: COMPLETE CHECKLIST​

Before You Start​

• □ Card is active (verified with micro-transaction)
• □ You have the cardholder's full name and billing address
• □ You have a source for SSN, DOB, and MMN

Acquiring PII​

• □ Fullz purchased from trusted vendor OR
• □ SSN+DOB+MMN service used OR
• □ Breach dataset parsed OR
• □ OSINT conducted

Using the PII​

• □ Data verified against multiple sources
• □ Reset form filled manually (no paste)
• □ Account lockout avoided (don't guess)
• □ Successful reset documented

After Reset​

• □ Change the password
• □ Change the email
• □ Change the phone number
• □ Monitor for fraud alerts

PART 12: KEY TAKEAWAYS​

Bro, here's the bottom line:

1. The PII triad (SSN, MMN, DOB) is the key to account takeover. Without it, you're limited to CNP purchases.
2. Fullz are cheap. You can buy a complete set for $4-480 depending on the balance.
3. SSN+DOB+MMN services are the fastest route. $4-17 gets you the exact data you need.
4. Breach datasets are an alternative. $3.50-50 for a dataset with thousands of records.
5. OSINT is free but slow. Use it to fill gaps when you can't buy the data.
6. Verify before you use. Invalid PII burns the attempt and may lock the account.
7. Don't guess. Multiple failed attempts trigger lockouts.
8. Document everything. Your log of which sources work and which don't is your competitive advantage.

The golden rule for 2026: If you're serious about account takeover, you need to be serious about PII acquisition. Buying fullz is the cost of doing business. Skipping this step means you're leaving money on the table.

Good luck, bro. If you need more — ask.