Pssstt... Wanna buy an identity? The price of data on the dark web
We all know that stolen information is traded on the dark web, and new research by Trustwave looks at what is available and how much it costs. It also uncovers the additional services that are being offered to make it easier to commit fraud.
Details of a stolen credit card can be bought for as little as $8. Much more valuable though is a card with 'fullz' -- extra information on the victim that makes the card more usable. These can cost up to $70.
Fullz can include name, address, social security number, driver's license, bank account credentials, and medical records, all wrapped up in one package and all of which enables the buyer to better utilize the stolen credential. Cloned cards, particularly those with higher credit limits, can be even more expensive, up to $1,500, because there’s more chance that they’re going to work.
"They want to make it compelling so they tried to make it very cheap," says Ziv Mador, VP of security research at Trustwave. "One of the ways to make them cheap is by selling the same merchandise over and over again. So they might sell the same stolen credit card to a couple of criminals, which means that not everything might work."
Evidence of the increasing professionalization of cybercrime though is that sometimes data will come with a 'guarantee'. If the buyer tries to use any of the card numbers and they don't work within a certain number of hours the seller will provide a replacement for free. Some sellers also offer customer support.
"There are people that have expertise in different areas, the whole spectrum of illegal activity. So some groups are good at capturing information, they have 1,000s of stolen credit cards, bank accounts, RDP access and so on, and they put them for sale," says Mador. "And others are criminal groups whose expertise is providing those points of data and actually using them to cash out to buy merchandise online, etc and make the money that way."
Another interesting development is that there are now sites offering to create false documentation to help a buyer prove to a bank or financial institution that they are in fact the true owner of the credentials they purchased. An ID document like a passport or drivers license can be less than $50 and a selfie holding a document -- as required by some account creation routines -- less than $10.
"Even during the COVID times when people need to have, let's say a negative result PCR test result for a flight, dark web sellers have provided them a fake one for a quarter of the cost," adds Mador.
You can read more on the Trustwave blog and there's an infographic summary below.
Image credit: Frank-Peters/depositphotos.com