What Criminals Pay to Buy Stolen Identities, and Tips to Keep Yours Safe

According to the Identity Theft Resource Center, 2023 was an unprecedented year for data breaches. With more than 2,100 in the first nine months of the year, many expect these compromises will drive new levels of identity crimes in 2024 and beyond. With the Federal Bureau of Investigation estimating that identity theft cases resulted in $10 billion in losses in 2022, the prospect of increasing identity theft cases in 2024 is concerning.

At SentiLink, we work with financial institutions to stop identity fraud when a consumer applies for a new account or loan. We see about 10,000 attempts at identity theft each day. Our team of risk analysts reviewed many of these cases individually, seeing criminals repeatedly trying to leverage their investment in compromised identity data to open new financial accounts, and it made them wonder: What's the market value of stolen personal information?

Interest piqued, they set out on an educational journey into the Dark Web in order to answer that question. This isn't hard to do: Many marketplaces operate at a layer of the Internet that requires only a little extra know-how to access, with countless tutorials available in readily accessible online forums. Others run their platform through social media storefronts. Here's what they found, including actual screenshots from PII marketplaces¹:

Complete stolen identities (aka "Fullz") sell for $5-$30, depending on the amount of PII available.

Buying a complete (aka, "Fullz") or nearly complete stolen identity is a modest investment. You'll pay more for extras like associated credit reports. Note that the identities of younger consumers command a higher premium, most likely due to having a randomized SSN, which can help facilitate synthetic fraud, or thinner credit files.

Stolen Driver's Licenses are for sale as well

In the above examples, most did not include driver's licenses. Those require an additional purchase. Extra disturbingly, some include an actual selfie image of the valid holder of the license.

SSNs are very inexpensive (a few dollars) and often paired for sale with corresponding birthdates

For fraud fighters, the low cost of SSNs is not surprising in the least. The idea that SSNs are a "private" identifier has long since evaporated.

  

Compromised bank accounts, including account numbers, passwords, routing numbers and balances, command a premium

Access to compromised checking accounts are high-value. It's likely that a fraudster buying one of the accounts shown below would still need to bypass 2FA in order to drain funds, however.

(note that we've modified the below posting to remove actual bank name and details)

Practical tips to protect your identity online

So what can consumers do to help prevent their information from popping up for sale in these markets? Here are some important tips:

1. Use a password manager to create long, randomly generated passwords that even you don't know. Bitwarden and 1Password are both good options. Don’t reuse passwords.

2. Set up MFA on any site that lets you, preferring non-email and non-SMS options which aren't susceptible to SIM-swapping attacks. Authy is a good option, or even better use a hardware FIDO 2 key, like YubiKey.

3. Sign up for free credit monitoring. Sites like Credit Karma offer this, as do many banks directly.

4. You can also consider freezing your credit reports by contacting the three bureaus:

   * Equifax

   * Experian

   * TransUnion

5. Always verify the identity of the person contacting you. If they claim to be an official from a specific organization, hang up and call back using an official contact number you find independently, not one provided by the caller.

6. Be wary of unsolicited requests for personal information or money. Legitimate organizations typically do not ask for sensitive details via phone, text, or email. Always double-check before providing any personal or financial information.

7. If you or someone you know is a victim of an identity crime or a financial scam, consider reaching out to victim assistance organizations such as the Identity Theft Resource Center nonprofit.

8. Lastly, practice vigilance and common sense. If something seems too good to be true it probably is. 

 ¹ Sourcing: Styx Marketplace