The dark web has a longstanding reputation as a haven for the worst kinds of criminal activity. This reputation is not wholly unjustified, as there are indeed terrible things happening around the world that can be bought and sold on the dark web.
Note: The updated Dark Web Pricing Index for 2021 has been posted here.
he privacy offered by software such as TOR creates an environment where criminals can sell their wares on the dark web without the worry of law enforcement.What’s more, many will have heard the horror stories of people’s bank accounts being cleaned out, or their identity stolen and turning up in custody in Mexico. Again, not unjustified horror.You might be asking yourself, just how easy is it to obtain someone else’s personal information, documents, account details?We certainly were.To see just how prevalent such items of personal data are being listed, and at what price, we sent our researchers on a data-gathering mission into the dark web.
| Category | Product | Avg. dark web Price (USD) |
| Credit Card Data | Cloned Mastercard with PIN | $15 |
| Cloned American Express with PIN | $35 | |
| Cloned VISA with PIN | $25 | |
| Credit card details, account balance up to $1000 | $12 | |
| Credit card details, account balance up to $5000 | $20 | |
| Stolen online banking logins, minimum $100 on account | $35 | |
| Stolen online banking logins, minimum $2000 on account | $65 | |
| Walmart account with credit card attached | $10 | |
| Payment processing services | Stolen PayPal account details, minimum $100 | $198.56 |
| PayPal transfer from stolen account, $1000 – $3000 | $320.39 | |
| PayPal transfers from stolen account, $3000+ | $155.94 | |
| Western Union transfer from stolen account, above $1000 | $98.15 | |
| Forged documents | US driving license, average quality | $70 |
| US driving license, high quality | $550 | |
| Auto insurance card | $70 | |
| AAA emergency road service membership card | $70 | |
| Wells Fargo bank statement | $25 | |
| Wells Fargo bank statement with transactions | $80 | |
| Rutgers State University student ID | $70 | |
| US, Canada, or Europe passport | $1500 | |
| Europe national ID card | $550 | |
| Social Media | Hacked Facebook account | $74.5 |
| Hacked Instagram account | $55.45 | |
| Hacked Twitter account | $49 | |
| Hacked Gmail account | $155.73 | |
| Instagram followers x 1000 | $7 | |
| Spotify followers x 1000 | $3 | |
| Twitch followers x 1000 | $6 | |
| Tick Tok followers x 1000 | $15 | |
| LinkedIn followers x 1000 | $10 | |
| LinkedIn company page followers x 1000 | $10 | |
| Pinterest followers x 1000 | $5 | |
| Soundcloud plays x 1000 | $1 | |
| Daily Motion views x 1000 | $2 | |
| Twitter retweets x 1000 | $25 | |
| Instagram likes x 1000 | $6 | |
| Malware | Global low quality, slow speed, low success rate x 1000 | $70 |
| Europe low quality, slow speed, low success rate x 1000 | $300 | |
| USA, CA, UK, AU low quality, slow speed, low success rate x 1000 | $800 | |
| Global med quality, 70% success rate x 1000 | $80 | |
| Europe med quality, 70% success rate x 1000 | $700 | |
| USA only med quality, 70% success rate x 1000 | $900+ | |
| USA, CA, UK, AU med quality, 70% success rate x 1000 | $1300 | |
| Europe fresh high quality x 1000 | $2300 | |
| Europe aged high quality x 1000 | $1400 | |
| USA high quality x 1000 | $1700 | |
| CA high quality x 1000 | $1500 | |
| UK high quality x 1000 | $2000 | |
| Android x 1000 | $600 | |
| Premium x 1000 | $6000 | |
| DDoS Attack | Unprotected website, 10-50k requests per second, 1 hour | $10 |
| Unprotected website, 10-50k requests per second, 24 hours | $60 | |
| Unprotected website, 10-50k requests per second, 1 week |
$400+ | |
| Unprotected website, 10-50k requests per second, 1 month | $800+ | |
| Premium protected website, 20-50k requests per second, multiple elite proxies, 24 hours | $200 |
Chapters
What We Found
Whilst there are many marketplaces on the dark web, there are even more forum posts warning of scammers. This makes verified prices difficult to obtain without ordering the items to find out, which of course we didn’t.
Our methodology was to scan dark web marketplaces, forums, and websites, to create an index of the average prices for a range of specific products.
We were only interested in products and services relating to personal data, counterfeit documents, and social media.
This is what we found.
Cloned credit cards and associated data
| Product | Average dark web Price (USD) |
| Cloned Mastercard with PIN | $15 |
| Cloned American Express with PIN | $35 |
| Cloned VISA with PIN | $25 |
| Credit card details, account balance up to $1000 | $12 |
| Credit card details, account balance up to $5000 | $20 |
| Stolen online banking logins, minimum $100 on account | $35 |
| Stolen online banking logins, minimum $2000 on account | $65 |
| Walmart account with credit card attached | $10 |
Credit card details usually come in the format CC|MM|YY|CVV|HOLDER_NAME|ZIP|CITY|ADDRESS|EMAIL|PHONE with the first 4 sections being the details on the card and the rest the details of the account holder. This will definitely cause a major inconvenience, but the prospect of someone using your online banking logins to gain full access to your account is far more daunting.
Vendors tend to offer a guarantee of 80%. Meaning that two of every ten cards either won’t work or will have less than the advertised balance. We didn’t order any so can’t verify whether this is true, but the prevalence of these claims alongside the well documented increase in identity fraud cases suggests that there is a high turnover of such data.
Payment processing services
| Product | Average dark web Price (USD) |
| Stolen PayPal account details, minimum $100 | $198.56 |
| PayPal transfer from stolen account, $1000 – $3000 | $320.39 |
| PayPal transfers from stolen account, $3000+ | $155.94 |
| Western Union transfer from stolen account, above $1000 | $98.15 |
PayPal account details were easily the most common items listed, and extremely cheap. More expensive was actual transfers from a hacked account.
Another very common item for sale was guides on how to “cash out” – actually get the money in a way that doesn’t alert the authorities. These guides go for a few cents, but whether or not they actually work is not what we were looking for.
Forged documents
| Product | Average dark web Price (USD) |
| US driving license, average quality | $70 |
| US driving license, high quality | $550 |
| Auto insurance card | $70 |
| AAA emergency road service membership card | $70 |
| Wells Fargo bank statement | $25 |
| Wells Fargo bank statement with transactions | $80 |
| Rutgers State University student ID | $70 |
| US, Canada, or Europe passport | $1500 |
| Europe national ID card | $550 |
These documents came with a range of guarantees and are available with any details the buyer chooses. With just a few pieces of real information about someone, a criminal could create a whole file of official documents to be used for all sorts of fraudulent activities. This one way in which an identity is stolen.
Counterfeit money
Counterfeit banknotes are extremely common, mainly in 20 or 50 denominations.
We came across USD, EUR, GBP, CAD, AUD most often. Some come with a UV pen test guarantee. The “quality” ones tend to cost around 30% of the banknote value.
This article was originally published on PrivacyAffairs. The complete version of it can be found there.
