From your PayPal login to access to your Amazon and Airbnb accounts and basic financial details tied to your credit cards — among dozens of other logins — your entire online identity is worth about the price of a new iPhone X.
It’s pretty cheap for a thief to illegally buy the average person’s stolen personal information on the dark web — $1,170.74 to be exact, according to a review of fraud-related listings by the VPN review site TOP10VPN.
In what it calls the Dark Web Market Price Index, the site details how would-be scammers could spend more on going out to lunch than on getting hacked accounts such as Grubhub ($15), Walmart ($12) or Netflix ($8).
The VPN site’s security experts reviewed tens of thousand of listings on three of the most popular dark web markets. These are encrypted websites that can only be reached using the Tor browser. Once there, criminals can anonymously sell stolen personal information and other illegal things such as illicit drugs and weapons.
The experts focused on listings featuring stolen ID, hacked accounts and personal information, and calculated the average sales price for each item. To buy someone’s entire identity and have all of the items on the list, the total cost is $1,170 on average.
Thieves want your credit card the most
Stolen credit card numbers can be used immediately to buy something online, and credit card numbers and related financial details were some of the most valuable hacked items on the list.
Credit cards sell for an average of $500, the same price as bank logins. Some hacked logins come with a credit card added, such as a Costco login with a credit card for only $5. A Pizza Hut login for ordering pizzas online is only $6 and includes a credit card that can then be used to buy much more than pizza.
Selling prices for credit cards tend to be 10 percent of the available credit balance, researchers found. PayPal accounts have much higher demand, asking double that of credit cards. Verified PayPal accounts with high balances of $10,000 that come with an email address and password cost $2,000.
Bundles of “full” identifying information, called “Fullz,” cost as much as $515 for guaranteed access to a Wells Fargo online account. They can include an individual’s name, billing address, mother’s maiden name, Social Security number, date of birth and other personal data.
Setting up lines of credit in someone else’s name is the main tactic of cybercriminals. Along with credit card and personal information, they’ll buy digital proof of identity such as passport scans ($16) or a real passport ($2), selfies and utility bills. For $52, a driver’s license scan, SSN and utility bill are included as a package.
For less than $10, hacked online shopping accounts are sold and provide many fraud opportunities. If you store payment details on Amazon, Bestbuy and other online stores, hackers can order items online and sell them for cash. A hacked Amazon account is $6 and a Bestbuy is $15. For a Bestbuy login with instant delivery, it’s only $9.
Hacked eBay accounts for $15 allow criminals to dupe buyers into sending them money for fake listings or to buy expensive goods with the account owner’s funds to intercept and sell later.
Remember your summer vacation?
If you don’t remember much about your summer vacation, thieves do. For an average sale price of less than $8, hacked Airbnb accounts can allow hackers to change hosts payment details and steal their earnings, and use accounts of highly-rated guests to book stays in premium properties and burglarize the hosts.
Uber accounts are $7, allowing someone in Russia to take free rides on your account. For $3, a booking.com account can be hacked to send fake emails to people to get them to make high payments for their travel arrangements or to steal their credit card details.
Did you order a meal delivered with Grubhub while on vacation? For $6 to $15, you could be that person who had $179 worth of food delivered in another state from a stolen account.
Personal stuff you do online
Facebook logins average $5.20, which is more than double other social media accounts. Facebook offers a lot of personal data to gain access to more lucrative accounts or commit ID theft.
Email accounts are cheap, mainly because there are millions of hacked email accounts for sale. An AOL email login and password is $4, five Gmail accounts are $2.59 and 10 Yahoo email accounts are $4. Gmail may be so cheap because with strong security through two-factor authentication and suspicious login warnings, access can be quickly revoked and the hacked details are useless.
Protecting your ID
You probably know many ways to protect your online identity, but aren’t following them. Start by checking your credit report for free at least once a year to look for accounts you haven’t opened. Sign up for alerts from your credit card company for suspected fraud, such as large charges in another state.
Shop only on secure websites, don’t use public Wi-Fi to shop, have strong passwords, and don’t tell any retailer your date of birth, Social Security number or income level.
Such simple steps can prevent you from being defrauded of much more than the $1,200 it can cost a hacker to get your online personal information.