Here's how much cybercrooks pay for your stolen personal data

News
By published

Pilfered personal information can fetch up to $6,000 in criminal forums

cyber crooks hacking computers
(Image credit: Shutterstock)

A new study gives us a first-hand glimpse into the prices that compromised credit cards, bank accounts and other stolen information can sell for in online criminal marketplaces. 

Security researchers at Privacy Affairs have put together a list that shows how much  cybercriminals charge for stolen data on hacker forums.

Breaking down the prices

According to the Privacy Affairs report, American Express cards with valid PINs are the most profitable stolen credit cards, selling for an average of $35 each. But login credentials for online bank accounts that have balances of at least $2,000 generally list for $65 apiece.

The researchers also looked at non-credit-card payment processing services and found that stolen PayPal details are hugely in demand on these forums. PayPal transfers of $1,000-$3,000 sell for an average of $320, but oddly, larger PayPal transfers of $3,000 or more sell for only an average of $156. 

When it comes to forged documents, U.S., Canadian and European passports go for a staggering average of $1,500. Meanwhile, both “high quality” American drivers' licenses and European national ID cards command average prices of $550.

Among compromised social networking and webmail accounts, the most expensive type is a Gmail account, which would sell for an average of $155.73 per account. Other in-demand account types include Facebook accounts ($74.50), Instagram accounts ($55.45) and Twitter accounts ($49).

Selling their criminal expertise 

Because cybercrime has become a service industry, crooks also sell malware and distributed-denial -of-service (DDoS) attack services via these forums. Average price tags for 1,000 malware installations range from $70 to $6,000, depending on the malware's quality, success rate and geographical target area.  

Meanwhile, DDoS attacks can be as cheap as an average $10 per hour for attacks on unprotected websites, with bulk discounts for longer periods of time. But for DDoS attacks on "premium" protected websites, those rates triple.

“For the average person, underground market data isn’t necessarily going to provide much use as they most likely aren’t shopping around for stolen card data or PayPal accounts. Though this is true, the prices at which these items sell provide a powerful perspective,” wrote Miguel Gomez, a cyber security expert at Privacy Affairs. 

“If someone gets their hands on your financial details or social media credentials, the prices mentioned above is basically what it’s worth to them. There’s a good chance that you value these things much more than they do, as to them you’re just another mark for a quick buck.”

To prevent cyber criminals from gaining access to your data, you should use strong passwords (and one of the best password managers), avoid reusing passwords on different accounts, use security mechanisms like two-factor authentication, question how much personal information you really need to share and download and use one of the best antivirus programs. 

  • More: Online security is just one of many handy VPN uses
TOPICS
Nicholas Fearn

Nicholas Fearn is a freelance technology journalist and copywriter from the Welsh valleys. His work has appeared in publications such as the FT, the Independent, the Daily Telegraph, The Next Web, T3, Android Central, Computer Weekly, and many others. He also happens to be a diehard Mariah Carey fan!