How much is your personal data worth to you? A lot. And how much is it worth to an identity thief? You may be surprised, or insulted, or enraged, to find out.
Verified high-limit credit cards from countries including the US, Japan and South Korea are selling on the dark Web for the bitcoin equivalent of about US$10 to $20 (R130 to R260), according to an annual report on cybercrime by Secureworks, a unit of Dell.
The dark Web is “the collection of Internet forums, digital shop fronts and chat rooms that cybercriminals use to form alliances, trade tools and techniques, and sell compromised data that can include banking details, personally identifiable information and other content”, as Secureworks defines it.
Verified means the seller has tested transactions on the card and found it hasn’t been cancelled yet. For scammers on a budget, there’s unverified stolen credit card data, which comes out to a few cents a card when bought in bulk.
This is a screen grab of merchandise for sale on the dark Web. It’s a little fuzzy but you get the awful idea.
Credit cards generally aren’t selling any cheaper on the dark Web these days, said Alex Tilley, a senior security researcher on Secureworks’ counter threat unit research team. But buyers are more likely to get higher-quality cards today, ones with sizeable limits and suitable properties for fraud. It isn’t as hit-or-miss as it used to be — a welcome change for criminals, chilling news for most of us.
Business credit cards are in favour, since they sometimes have no limit on spending, Tilley said. Those and high-end personal cards — say, a Platinum American Express that has been verified and has an 85% rating (judged by the seller to have an 85% chance of being successfully used in a fraud) — will go for $15 to $20. A regular Mastercard that doesn’t have a big limit might go for $9. An underground market inexplicably called Trump’s Dumps is one of the many sellers of this kind of stolen credit card data.
Full identities
But wait, there’s more. Underground markets also sell full identities of individuals just like you for as little as $10 apiece. They’re called fullz, “dossiers that provide enough financial, geographic and biographical information on a victim to facilitate identity theft or other impersonation-based fraud,” the report explains. Fullz can help a criminal get past those irritating “secret questions” that sites ask to verify your identity.
Recently, Secureworks’ researchers have seen more offers of bulk pre-verified card details, along with more identifying information about the owners. In some cases, offers even include the cardholder’s mother’s maiden name. Still, they cost just $10 to $12.
In fact, the prices Secureworks cites for these examples of personal data are lower than what fraudsters have been willing to pay for documents like W-2s, which can be used to file false tax returns. Tax-filing data, which doesn’t expire, can go for about $40 to $50, according to a report from IBM’s security research group, known as the IBM X-Force, published earlier this year. The researchers found one vendor selling American W-2 and 1040 returns as a package for $30; if a buyer wanted information on that person’s adjusted gross income it would be another $20.
No piece of personal information is innocuous, Tilley said. Criminals will amass bits of data on people, waiting until they have enough that their fraud attempt is likely to succeed.
“Everything is valuable,” he said. One bit of information “could be the last piece of a puzzle someone needed to take out a loan in your name. You don’t know how far along criminals are until it’s too late.”
Credit monitoring and freezes could be the only hope of protecting yourself, Tilley said. “The problem is that you put a lot of trust in the third-party companies that hold your data, and that’s a little out of your control.” — Reported by Suzanne Woolley, (c) 2017 Bloomberg LP