Complete Personal Fraud Kits Sell for Less Than $40 on Dark Web
The low cost of records reflects the huge supply of PII after many breaches at hospitals, government agencies, and credit bureaus.
When a complete set of personally identifiable information (PII) is sold on the Internet, it's all a criminal needs to steal an identity. And research has shown that the cost to steal that identity is only $30 to $40.
A "fullz" for a US consumer contains a person's full name, birth date, Social Security number, address, phone number, driver's license number, and mother's maiden name. For an extra $10 to $25, sellers will add an individual's credit card data, bank account data, bank security questions and answers, employer, or other critical information.
The new research, by Armor Defense, found PII merchants who gave instructions on how the information can be used to commit bank fraud and tips on getting information that might be missing from a record — one seller, for example, suggested going to Ancestry.com to find a victim's mother's maiden name.
Although costs for a fullz differ from country to country, the generally low cost of the records reflects the huge supply of PII after a series of breaches at hospitals, government agencies, and credit bureaus.
For more, read here.
Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024