Dark Web Price Index 2021 - Dark Web Prices of Personal Data
Dark Web Price Index 2021
Zachary Ignoffo
Updated: 7 July 2021
Miklos Zoltan
Fact-checked by
11
Comments
You wouldn’t know it by watching the news, with everything that’s been happening surrounding the pandemic and global politics, but up until this point, 2020 has been one of the worst years for cyber attacks.
Notable corporations and organizations like NASA, McDonald’s, Microsoft, T-Mobile, Lockheed Martin, even cybersecurity companies FireEye and SolarWinds have all been victims to serious breaches in 2020 alone.
Where does all of this leaked information end up? For sale on the Dark Web of course. We investigated how the Dark Web market has changed since our previously reported Dark Web Price Index 2020, so you can understand what your personal information is worth and why you should protect it.
Info reflects data collected on May 9 2021.
This is what we found:
Category Product Avg. dark web Price (USD)
Credit Card Data Cloned Mastercard with PIN $25
Cloned American Express with PIN $35
Cloned VISA with PIN $25
Credit card details, account balance up to $1,000 $150
Credit card details, account balance up to $5,000 $240
Stolen online banking logins, minimum $100 on account $40
Stolen online banking logins, minimum $2,000 on account $120
Walmart account with credit card attached $14
Hacked (Global) credit card details with CVV $35
USA hacked credit card details with CVV $17
UK hacked credit card details with CVV $20
Canada hacked credit card details with CVV $28
Australia hacked credit card details with CVV $30
Israel hacked credit card details with CVV $65
Spain hacked credit card details with CVV $40
Japan hacked credit card details with CVV $40
Payment processing services Stolen PayPal account details, minimum $100 $30
Stolen PayPal account details, minimum $1,000 $120
PayPal transfers from stolen account, $100-$1,000 $50
PayPal transfer from stolen account, $1,000 – $3,000 $340
PayPal transfers from stolen account, $3,000+ $180
Western Union transfer from stolen account, above $1,000 $45
Stolen PayPal account details, no balance $14
Stolen UK fully verified Skrill account details $200
Hacked TransferGo account $510
50 Hacked PayPal account logins $200
Hacked UK Neteller account $70
Hacked PerfectMoney account $160
Hacked Weststein Card account $710
Movo.Cash Login $14
Hacked Western Union Account $45
Verified Stripe account with payment gateway $1,000
Crypto Accounts Hacked Coinbase verified account $610
USA verified LocalBitcoins account $350
Crypto.com verified account $300
Coinfield.com verified account $410
Kraken verified account $810
Cex.io verified account $710
Blockchain.com verified account $310
Binance verified account $410
Social Media Hacked Facebook account $65
Hacked Instagram account $45
Hacked Twitter account $35
Hacked Gmail account $80
Instagram followers x 1000 $5
Spotify followers x 1000 $2
Twitch followers x 1000 $5
LinkedIn company page followers x 1000 $12
Pinterest followers x 1000 $4
Soundcloud plays x 1000 $1
Twitter retweets x 1000 $25
Instagram likes x 1000 $5
Hacked Services Uber driver hacked account $14
Uber hacked account $8
ZipCar account $12
Bet365 account $50
Lykke account $260
FedEx account $22+
Netflix account – 1 year subscription $44
Kaspersky account $8
Various adult site accounts $5
Canva Pro yearly $6
NBA League Pass $8
Orange TV $4
Hulu $5
The Telegraph UK Premium $7
CNBC Pro $3
Netflix 4K 1 year $4
HBO $4
Ancestry.com $8
Adobe Creative Cloud 1 year $160
eBay account with good reputation (1,000+ feedback) $1,000
Forged Documents – Scans Alberta CA Drivers License (scan) $32
Minnesota drivers license $20
Utility Bill templates $39+
US Business cheque templates $15
NSW (Australia) drivers license $20
Russian passport scan $100
New York drivers license $80
USA selfie with holding ID $100
US valid social security number $2
Forged Documents – Physical Fake US Green Card $150
New Jersey ID $50
Netherlands Passport $4,000
Poland Passport $4,000
Indiana ID $185
Texas ID $145
Utah ID $160
European Union National ID (avg.) $120
Latvian National ID $500
Louisiana ID $125
Montana ID $150
Nevada ID $160
Delaware ID $185
France Passport $4,000
Lithuanian passport $1,500
Maltese Passport $6,500
Maltese Passport $6,500
Various European Union passports $4,000
US driver’s license $100
Email Database Dumps Fake US Green Card $150
600k New Zealand emails $10
350k Czech emails $10
2,4 million Canada emails $10
4,78 million Mexico emails $10
380k Austria emails $10
Private USA dentists database 122k $50
USA Voter Database (various states) $100
Malware Global low quality, slow speed, low success rate x 1000 $50
Europe low quality, slow speed, low success rate x 1000 $320
USA, CA, UK, AU low quality, slow speed, low success rate x 1000 $900
Global med quality, 70% success rate x 1000 $80
Europe med quality, 70% success rate x 1000 $500
USA only med quality, 70% success rate x 1000 $1,000
USA, CA, UK, AU med quality, 70% success rate x 1000 $1,400
Europe fresh high quality x 1000 $2,500
Europe aged high quality x 1000 $1,200
USA high quality x 1000 $1,900
CA high quality x 1000 $1,400
UK high quality x 1000 $2,200
Android x 1000 $900
Premium x 1000 $5,000
DDOS Attacks Unprotected website, 10-50k requests per second, 1 hour $15
Unprotected website, 10-50k requests per second, 24 hours $50
Unprotected website, 10-50k requests per second, 1 week $500
Unprotected website, 10-50k requests per second, 1 month $1,000
Europe low quality, slow speed, low success rate x 1000 $320
Premium protected website, 20-50k requests per second, multiple elite proxies, 24 hours $200
In This Guide
1. What We Found
2. Cloned Credit Cards and Cardholder Data
3. Payment Processing Services
4. Crypto Accounts
5. Social Media
6. Hacked Services
7. Forged Documents - Scans and Physical
8. Email Database Dumps
9. Malware
10. DDOS Attacks
11. Why This Data is Important
12. How to Protect Yourself From Identity Theft
What We Found
As predicted, there is much more volume being sold now compared to last year, with fake ID and credit card vendors reporting sales in the several thousands. Not only quantity, but the variety of items to purchase has grown as well, such as hacked crypto accounts and web services like Uber accounts.
This is a vendor profile of someone selling stolen credit card data. It has accumulated more than 1,000 sales and over 600 positive reviews in just a year:
Dark Web Vendor Profile
There are hundreds of vendors like the above.
With the massive influx of supply, buyers seem to be gravitating towards bigger, “trustworthy” sites, with White House Market holding the largest market share of sales. The Dark Web markets are even starting to parody traditional markets with comical offers of “buy 2 cloned credit cards and get 1 for free!!” for example.
In an effort to mitigate detection and tracking by law enforcement, the Dark Web is moving towards increased security on all ends. The markets have abandoned Bitcoin (BTC) as it is not secure, and vendors are demanding buyers to use Monero as payment and communicate only through PGP encryption.
Our methodology was to scan dark web marketplaces, forums, and websites, to create an index of the average prices for a range of specific products.
To further illustrate how this marketplace is thriving, below you can find a snapshot of a vendor profile with buyer ratings. This fake ID vendor seemingly registers sales every day:
Dark Web Vendor Feedback
Cloned Credit Cards and Cardholder Data
Despite the increasing supply, prices for cloned credit cards and associated cardholder data actually seemed to increase across the board. The price increase is most likely due to a combination of factors like the increasing risks of attaining the information, the increasing benefit for buyers to use the information, the increased quality/accuracy of the card data, or just good ol’ inflation.
Vendors of stolen credit card data tend to offer a guarantee of 80%, which means that two out of every ten cards either aren’t accurate or they have less than the advertised balance. Credit card records and cardholder data are typically sold in the format [CC|MM|YY|CVV|HOLDER_NAME|ZIP|CITY|ADDRESS|EMAIL|PHONE], the first 4 sections are card details and the following 5 sections show the cardholder information.
Updated Pricing (Oct. 2020 to Feb. 2021)
Product Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Cloned Mastercard with PIN $15 $25 +$10
Cloned American Express with PIN $35 $35 $0
Cloned VISA with PIN $25 $25 $0
Credit card details, account balance up to $1,000 $12 $15 +$3
Credit card details, account balance up to $5,000 $20 $24 +$4
Stolen online banking logins, minimum $100 on account $35 $40 +$5
Stolen online banking logins, minimum $2,000 on account $65 $120 +$55
Walmart account with credit card attached $10 $14 +$4
We have also includes several new “products” that weren’t covered in our 2020 version of this index.
New Products on Price Index
Credit Card Details Avg. Price USD (2021)
Hacked (Global) credit card details with CVV $35
USA hacked credit card details with CVV $17
UK hacked credit card details with CVV $20
Canada hacked credit card details with CVV $28
Australia hacked credit card details with CVV $30
Israel hacked credit card details with CVV $65
Spain hacked credit card details with CVV $40
Japan hacked credit card details with CVV $40
Many new listings of credit card details are categorized by country, which suggests where the breach took place, the accuracy of the credit card details, and the usefulness of the stolen data.
You can see that USA hacked credit card details are valued the lowest (due to high supply), and Israel the highest.
Example of stolen credit cards being sold on the dark web (vendor names have been removed):
Dark Web Stolen Credit Cards
Payment Processing Services
PayPal account details are easily the most abundant items listed on these dark web marketplaces, and as such they’re extremely inexpensive to purchase. The more expensive option is actual transfers from a hacked account.
As you can see in the below table, account details have dropped significantly in price, while the price of transfers have increased.
To accompany the purchase of payment processing accounts, another commonly listed item is guides on how to cash out the transfer without alerting the authorities. These guides sell for cents on the dollar, and whether they actually work remains unclear.
Updated Pricing (Oct. 2020 to Feb. 2021)
Payment Processing Services Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Stolen PayPal account details, minimum $100 $199 $30 -$169
Stolen PayPal account details, minimum $1,000 – $120 –
PayPal transfers from stolen account, $100-$1,000 – $5 –
PayPal transfers from stolen account, $1,000-$3,000 $320 $340 +$20
PayPal Transfer from stolen account, $3,000+ $156 $180 +$24
Western Union verified account $98 $45 -$53
New Products on Price Index
Payment Processing Services Avg. Price USD (2021)
Stolen PayPal account details, no balance $14
Hacked TransferGo account $510
50 Hacked PayPal account logins $200
Hacked UK Neteller account $70
Hacked PerfectMoney account $160
Hacked Weststein Card account $710
Movo.Cash Login $14
Hacked Western Union Account $45
Verified Stripe account with payment gateway $1,000
Payment processors have become more and more prevalent as retailers accept mobile pay and other forms of online payment. These payment processors vary in cybersecurity capabilities and insurance, so the value of a hacked account is likely to fluctuate as a result.
Example of stolen banking and payment processing information being sold on the dark web:
Bank Logins Dark Web
Crypto Accounts
Hacked crypto accounts seem to be one of the most valuable items for purchase. Due to the skyrocketing prices of BTC and other cryptocurrencies, hacked accounts may hold large sums of coin-based currency and cash, protected by relaxed security measures after the initial verification process.
The high-value accounts matched with abundant BTC ATMs for anonymous cash-out make crypto accounts a very valuable item for hackers.
Crypto $Avg. Price USD (2021)
Hacked Coinbase verified account $610
USA verified LocalBitcoins account $350
Crypto.com verified account $300
Coinfield.com verified account $410
Kraken verified account $810
Cex.io verified account $710
Blockchain.com verified account $310
Binance verified account $410
Example listings of hacked cryptocurrency site accounts being sold:
Dark Web Crypto Accounts
Social Media
Whether it’s the increased supply of hacked information or the diminishing value of an individual hacked account, prices for hacked social media accounts seem to be dropping across all platforms. Additionally, offers to hack specific accounts or sell them were relatively scarce, but there were still some.
Given the recent increase in security measures (e.g., MFA, account locks on too many attempted passwords) implemented by social media platforms, hackers must resort to social engineering techniques to gain login credentials, which is a very labor intensive endeavor for a relatively low success ratio.
Also worth noting, the extremely low cost of social engagement (e.g., likes and follows). This just proves how easy it is for some to gain influence through social proof with just a few bucks.
Updated Pricing (Oct. 2020 to Feb. 2021)
Social Media Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Hacked Facebook account $75 $65 -$10
Hacked Instagram account $55 $45 -$10
Hacked Twitter account $49 $35 -$14
Hacked Gmail account $156 $80 -$76
Instagram followers x 1000 $7 $5 -$2
Spotify followers x 1000 $3 $2 -$1
Twitch followers x 1000 $6 $5 -$1
LinkedIn x 1000 $10 $12 +$2
Pinterest followers x 1000 $5 $4 -$1
Soundcloud plays x 1000 $1 $1 $0
Twitter retweets x 1000 $25 $25 $0
Instagram likes x 1000 $6 $5 -$1
Example of hacked social media accounts for sale:
Dark Web Social Media
Hacked Services
Vendors even sell access to paid online subscription services at lower prices for those willing to take the risk.
Hacked Services Avg. Price USD (2021)
Uber driver hacked account $14
Uber hacked account $8
ZipCar account $12
Bet365 account $50
Lykke account $260
FedEx account $22+
Netflix account – 1 year subscription $44
Kaspersky account $8
Various adult site accounts $5
Canva Pro yearly $6
NBA League Pass $8
Orange TV $4
Hulu $5
The Telegraph UK Premium $7
CNBC Pro $3
Netflix 4K 1 year $4
HBO $4
Ancestry.com $8
Adobe Creative Cloud 1 year $160
eBay account with good reputation (1,000+ feedback) $1,000
Examples of various hacked online accounts being sold:
Dark Web Hacked Services
Forged Documents - Scans and Physical
Forged documents are available as digital scans or as physical documents. Depending on the vendor, they are highly customizable and can be made with any details that the buyer wants, so with just a few pieces of real information, a criminal could create an entire file of forged official-looking documents.
Document scans with selfie is another valuable purchase as they can be used for SIM swap attacks as well as personal data access requests in California and in the EU.
Besides the documents listed in the table below, counterfeit money is also extremely prevalent, mainly in denominations of 20 or 50 USD. We found USD, EUR, GBP, CAD, AUD were the most common, and some came with a UV pen test guarantee. The reported “high-quality” counterfeit banknotes typically cost around 30% of the banknote value.
Document Scans Avg. Price USD (2021)
Alberta CA Drivers License (scan) $32
Minnesota drivers license $20
Utility Bill templates $39+
US Business cheque templates $15
NSW (Australia) drivers license $20
Russian passport scan $100
New York drivers license $80
USA selfie with holding ID $100
US valid social security number $2
Example listings of fake documents being sold on the dark web (digital form):
Fake Documents Dark Web - Scans
Physical forged documents are also being sold. These are the highest priced items on the dark web markets by far.
Physical Documents Avg. Price USD (2021)
Fake US Green Card $150
New Jersey ID $50
Netherlands Passport $4,000
Poland Passport $4,000
Indiana ID $185
Texas ID $145
Utah ID $160
European Union National ID (avg.) $120
Latvian National ID $500
Louisiana ID $125
Montana ID $150
Nevada ID $160
Delaware ID $185
France Passport $4,000
Lithuanian passport $1,500
Maltese Passport $6,500
Maltese Passport $6,500
Various European Union passports $4,000
US driver’s license $100
Example listings of forged documents being sold on the dark web (physical form):
Dark Web Forged Passports
Email Database Dumps
Email dumps are very common and notoriously inexpensive due to their mainstream availability and low accuracy. Most email dumps are aggregations and collections of other email breaches.
Email Dumps Avg. Price USD (2021)
Fake US Green Card $150
600k New Zealand emails $10
350k Czech emails $10
2,4 million Canada emails $10
4,78 million Mexico emails $10
380k Austria emails $10
Private USA dentists database 122k $50
USA Voter Database (various states) $100
Example listings email database dumps being sold:
Dark Web Emails
Malware
Once installed on compromised systems (e.g., Windows, Android and others), malware gives hackers full access to the machine, which can be used to hijack computer resources via ransomware or to steal information about the user.
Common ways of implementing the malware is via fake online casinos, FB/social networks, warez websites etc. so beware downloading anything from untrusted sites and sources.
For every 1,000 installs, hackers stand to steal tens of thousands of dollars.
Updated Pricing (Oct. 2020 to Feb. 2021)
Malware Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Global low quality, slow speed, low success rate x 1000 $70 $50 -$20
Europe low quality, slow speed, low success rate x 1000 $300 $320 +$20
USA, CA, UK, AU low quality, slow speed, low success rate x 1000 $800 $900 +$100
Global med quality, 70% success rate x 1000 $80 $80 –
Europe med quality, 70% success rate x 1000 $700 $500 -$200
USA only med quality, 70% success rate x 1000 $900 $1,000 +$100
USA, CA, UK, AU med quality, 70% success rate x 1000 $1,300 $1,400 +$100
Europe fresh high quality x 1000 $2,300 $2,500 +$200
Europe aged high quality x 1000 $1,400 $1,200 -$200
USA high quality x 1000 $1,700 $1,900 +$200
CA high quality x 1000 $1,500 $1,400 -$100
UK high quality x 1000 $2,000 $2,200 +$200
Android x 1000 $600 $900 +$300
Premium x 1000 $6,000 $5,000 -$1,000
Example listings of malware being sold on the dark web:
Dark Web Malware
DDOS Attacks
A distributed denial of service (DDoS) attack sends the target website thousands of connection requests per second to overload and crash the website’s server, thereby taking a website offline. Typically, no information is stolen through these attacks, but they are used to dox a website or cover up other hacking activities.
Updated Pricing (Oct. 2020 to Feb. 2021)
DDOS Attacks Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Unprotected website, 10-50k requests per second, 1 hour $10 $15 +$5
Unprotected website, 10-50k requests per second, 24 hours $60 $50 -$10
Unprotected website, 10-50k requests per second, 1 week $400 $500 +$100
Unprotected website, 10-50k requests per second, 1 month $800 $1,000 +$200
Premium protected website, 20-50k requests per second, multiple elite proxies, 24 hours $200 $200 –
Why This Data is Important
Dark web market data may not provide the average person with useful insights, but what they do provide is a powerful perspective into just how valuable your personal data really is, and how cheap it is to exploit you.
We’ve heard all the horror stories of unsuspecting victims losing their life savings or hackers selling cam footage on the deepest corners of the web, but it’s easy to think it will never happen to you. The sad truth is with the growing supply of personal information on the dark web, the likelihood and occurrence of devastating hacks increases every day.
The reality is that hackers rarely resort to targeting specific people. With the sheer quantity of data available for purchase, they just need to play the numbers game, and if you don’t protect yourself, you’ll be the one paying the price. By adopting a few, simple rules and habits, you’ll make it harder for hackers to get your data, and in doing so take yourself completely out of their crosshairs. Like we said, it’s just a numbers game.
How to Protect Yourself From Identity Theft
By following the below recommendations, you will be much more likely to avoid identity theft.
Avoid Public Wifi
Avoid public or unsecured WiFi. If you must log into an account on a network you don’t trust like at a coffee shop, use a VPN to encrypt all communications. If an attacker has admin access to the network you’re using, they can manipulate everything you’re doing and even forge bank websites.
Use Safe ATM Practices
Check for ATM skimmers. Skimmers are devices placed over an ATM (often exact replicas of the card reader) to read a card and send your information to a hacker. To check for skimmers, you should:
Press around the sides of the card slot and see if anything feels loose, they’re delicately mounted so they’ll move when pressed with a small amount of pressure.
Check for glue around the edges or tape. If you see any glue material, stay away from that ATM and call the bank.
If you have difficulty putting your card into the machine, stop trying and report it to the bank.
Check for fake keypads. Fake keypads are sometimes placed over the legitimate one to record your PIN number. They’re also often very loosely mounted. If it jiggles around a bit or if you notice the keypad is off-center, you should avoid using it.
Keep your Information Private
Avoid giving sensitive information over the phone to anyone, regardless of whether it is a requirement for some process. If possible, do it in person. And be sure to verify who you are talking to is who they say.
Use Anti-Malware Tools
Use anti-malware software such as AVG on your personal computer to check for malware, and make sure it’s set to automatically update.
Use Account & Password Hygiene
Never use the same password for multiple accounts. This is the easiest way for an attacker to gain access to your accounts. When a major list of account details is dumped on the dark web, your account details can be checked against other services such as email or banking, and you really don’t want them to have the same password.
Delete accounts you don’t use anymore. Old accounts can be compromised and used for password resets or similar attacks. However, if you don’t reuse passwords on multiple accounts, this is not really an issue.
Use a password manager such as LastPass or Keepass (both free) so you can have super strong password security for your accounts, and only need to remember one master password.
These rules may feel a bit complicated and burdensome, but once you get used to following them, they’ll become second nature. You develop a sense of cybersecurity that is vital online and in daily life.
These habits may seem burdensome, but over time it will become second-nature. In the end, you will be doing your part in protecting your digital identity and safeguarding your own future.
Zachary Ignoffo
Updated: 7 July 2021
Miklos Zoltan
Fact-checked by
11
Comments
You wouldn’t know it by watching the news, with everything that’s been happening surrounding the pandemic and global politics, but up until this point, 2020 has been one of the worst years for cyber attacks.
Notable corporations and organizations like NASA, McDonald’s, Microsoft, T-Mobile, Lockheed Martin, even cybersecurity companies FireEye and SolarWinds have all been victims to serious breaches in 2020 alone.
Where does all of this leaked information end up? For sale on the Dark Web of course. We investigated how the Dark Web market has changed since our previously reported Dark Web Price Index 2020, so you can understand what your personal information is worth and why you should protect it.
Info reflects data collected on May 9 2021.
This is what we found:
Category Product Avg. dark web Price (USD)
Credit Card Data Cloned Mastercard with PIN $25
Cloned American Express with PIN $35
Cloned VISA with PIN $25
Credit card details, account balance up to $1,000 $150
Credit card details, account balance up to $5,000 $240
Stolen online banking logins, minimum $100 on account $40
Stolen online banking logins, minimum $2,000 on account $120
Walmart account with credit card attached $14
Hacked (Global) credit card details with CVV $35
USA hacked credit card details with CVV $17
UK hacked credit card details with CVV $20
Canada hacked credit card details with CVV $28
Australia hacked credit card details with CVV $30
Israel hacked credit card details with CVV $65
Spain hacked credit card details with CVV $40
Japan hacked credit card details with CVV $40
Payment processing services Stolen PayPal account details, minimum $100 $30
Stolen PayPal account details, minimum $1,000 $120
PayPal transfers from stolen account, $100-$1,000 $50
PayPal transfer from stolen account, $1,000 – $3,000 $340
PayPal transfers from stolen account, $3,000+ $180
Western Union transfer from stolen account, above $1,000 $45
Stolen PayPal account details, no balance $14
Stolen UK fully verified Skrill account details $200
Hacked TransferGo account $510
50 Hacked PayPal account logins $200
Hacked UK Neteller account $70
Hacked PerfectMoney account $160
Hacked Weststein Card account $710
Movo.Cash Login $14
Hacked Western Union Account $45
Verified Stripe account with payment gateway $1,000
Crypto Accounts Hacked Coinbase verified account $610
USA verified LocalBitcoins account $350
Crypto.com verified account $300
Coinfield.com verified account $410
Kraken verified account $810
Cex.io verified account $710
Blockchain.com verified account $310
Binance verified account $410
Social Media Hacked Facebook account $65
Hacked Instagram account $45
Hacked Twitter account $35
Hacked Gmail account $80
Instagram followers x 1000 $5
Spotify followers x 1000 $2
Twitch followers x 1000 $5
LinkedIn company page followers x 1000 $12
Pinterest followers x 1000 $4
Soundcloud plays x 1000 $1
Twitter retweets x 1000 $25
Instagram likes x 1000 $5
Hacked Services Uber driver hacked account $14
Uber hacked account $8
ZipCar account $12
Bet365 account $50
Lykke account $260
FedEx account $22+
Netflix account – 1 year subscription $44
Kaspersky account $8
Various adult site accounts $5
Canva Pro yearly $6
NBA League Pass $8
Orange TV $4
Hulu $5
The Telegraph UK Premium $7
CNBC Pro $3
Netflix 4K 1 year $4
HBO $4
Ancestry.com $8
Adobe Creative Cloud 1 year $160
eBay account with good reputation (1,000+ feedback) $1,000
Forged Documents – Scans Alberta CA Drivers License (scan) $32
Minnesota drivers license $20
Utility Bill templates $39+
US Business cheque templates $15
NSW (Australia) drivers license $20
Russian passport scan $100
New York drivers license $80
USA selfie with holding ID $100
US valid social security number $2
Forged Documents – Physical Fake US Green Card $150
New Jersey ID $50
Netherlands Passport $4,000
Poland Passport $4,000
Indiana ID $185
Texas ID $145
Utah ID $160
European Union National ID (avg.) $120
Latvian National ID $500
Louisiana ID $125
Montana ID $150
Nevada ID $160
Delaware ID $185
France Passport $4,000
Lithuanian passport $1,500
Maltese Passport $6,500
Maltese Passport $6,500
Various European Union passports $4,000
US driver’s license $100
Email Database Dumps Fake US Green Card $150
600k New Zealand emails $10
350k Czech emails $10
2,4 million Canada emails $10
4,78 million Mexico emails $10
380k Austria emails $10
Private USA dentists database 122k $50
USA Voter Database (various states) $100
Malware Global low quality, slow speed, low success rate x 1000 $50
Europe low quality, slow speed, low success rate x 1000 $320
USA, CA, UK, AU low quality, slow speed, low success rate x 1000 $900
Global med quality, 70% success rate x 1000 $80
Europe med quality, 70% success rate x 1000 $500
USA only med quality, 70% success rate x 1000 $1,000
USA, CA, UK, AU med quality, 70% success rate x 1000 $1,400
Europe fresh high quality x 1000 $2,500
Europe aged high quality x 1000 $1,200
USA high quality x 1000 $1,900
CA high quality x 1000 $1,400
UK high quality x 1000 $2,200
Android x 1000 $900
Premium x 1000 $5,000
DDOS Attacks Unprotected website, 10-50k requests per second, 1 hour $15
Unprotected website, 10-50k requests per second, 24 hours $50
Unprotected website, 10-50k requests per second, 1 week $500
Unprotected website, 10-50k requests per second, 1 month $1,000
Europe low quality, slow speed, low success rate x 1000 $320
Premium protected website, 20-50k requests per second, multiple elite proxies, 24 hours $200
In This Guide
1. What We Found
2. Cloned Credit Cards and Cardholder Data
3. Payment Processing Services
4. Crypto Accounts
5. Social Media
6. Hacked Services
7. Forged Documents - Scans and Physical
8. Email Database Dumps
9. Malware
10. DDOS Attacks
11. Why This Data is Important
12. How to Protect Yourself From Identity Theft
What We Found
As predicted, there is much more volume being sold now compared to last year, with fake ID and credit card vendors reporting sales in the several thousands. Not only quantity, but the variety of items to purchase has grown as well, such as hacked crypto accounts and web services like Uber accounts.
This is a vendor profile of someone selling stolen credit card data. It has accumulated more than 1,000 sales and over 600 positive reviews in just a year:
Dark Web Vendor Profile
There are hundreds of vendors like the above.
With the massive influx of supply, buyers seem to be gravitating towards bigger, “trustworthy” sites, with White House Market holding the largest market share of sales. The Dark Web markets are even starting to parody traditional markets with comical offers of “buy 2 cloned credit cards and get 1 for free!!” for example.
In an effort to mitigate detection and tracking by law enforcement, the Dark Web is moving towards increased security on all ends. The markets have abandoned Bitcoin (BTC) as it is not secure, and vendors are demanding buyers to use Monero as payment and communicate only through PGP encryption.
Our methodology was to scan dark web marketplaces, forums, and websites, to create an index of the average prices for a range of specific products.
To further illustrate how this marketplace is thriving, below you can find a snapshot of a vendor profile with buyer ratings. This fake ID vendor seemingly registers sales every day:
Dark Web Vendor Feedback
Cloned Credit Cards and Cardholder Data
Despite the increasing supply, prices for cloned credit cards and associated cardholder data actually seemed to increase across the board. The price increase is most likely due to a combination of factors like the increasing risks of attaining the information, the increasing benefit for buyers to use the information, the increased quality/accuracy of the card data, or just good ol’ inflation.
Vendors of stolen credit card data tend to offer a guarantee of 80%, which means that two out of every ten cards either aren’t accurate or they have less than the advertised balance. Credit card records and cardholder data are typically sold in the format [CC|MM|YY|CVV|HOLDER_NAME|ZIP|CITY|ADDRESS|EMAIL|PHONE], the first 4 sections are card details and the following 5 sections show the cardholder information.
Updated Pricing (Oct. 2020 to Feb. 2021)
Product Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Cloned Mastercard with PIN $15 $25 +$10
Cloned American Express with PIN $35 $35 $0
Cloned VISA with PIN $25 $25 $0
Credit card details, account balance up to $1,000 $12 $15 +$3
Credit card details, account balance up to $5,000 $20 $24 +$4
Stolen online banking logins, minimum $100 on account $35 $40 +$5
Stolen online banking logins, minimum $2,000 on account $65 $120 +$55
Walmart account with credit card attached $10 $14 +$4
We have also includes several new “products” that weren’t covered in our 2020 version of this index.
New Products on Price Index
Credit Card Details Avg. Price USD (2021)
Hacked (Global) credit card details with CVV $35
USA hacked credit card details with CVV $17
UK hacked credit card details with CVV $20
Canada hacked credit card details with CVV $28
Australia hacked credit card details with CVV $30
Israel hacked credit card details with CVV $65
Spain hacked credit card details with CVV $40
Japan hacked credit card details with CVV $40
Many new listings of credit card details are categorized by country, which suggests where the breach took place, the accuracy of the credit card details, and the usefulness of the stolen data.
You can see that USA hacked credit card details are valued the lowest (due to high supply), and Israel the highest.
Example of stolen credit cards being sold on the dark web (vendor names have been removed):
Dark Web Stolen Credit Cards
Payment Processing Services
PayPal account details are easily the most abundant items listed on these dark web marketplaces, and as such they’re extremely inexpensive to purchase. The more expensive option is actual transfers from a hacked account.
As you can see in the below table, account details have dropped significantly in price, while the price of transfers have increased.
To accompany the purchase of payment processing accounts, another commonly listed item is guides on how to cash out the transfer without alerting the authorities. These guides sell for cents on the dollar, and whether they actually work remains unclear.
Updated Pricing (Oct. 2020 to Feb. 2021)
Payment Processing Services Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Stolen PayPal account details, minimum $100 $199 $30 -$169
Stolen PayPal account details, minimum $1,000 – $120 –
PayPal transfers from stolen account, $100-$1,000 – $5 –
PayPal transfers from stolen account, $1,000-$3,000 $320 $340 +$20
PayPal Transfer from stolen account, $3,000+ $156 $180 +$24
Western Union verified account $98 $45 -$53
New Products on Price Index
Payment Processing Services Avg. Price USD (2021)
Stolen PayPal account details, no balance $14
Hacked TransferGo account $510
50 Hacked PayPal account logins $200
Hacked UK Neteller account $70
Hacked PerfectMoney account $160
Hacked Weststein Card account $710
Movo.Cash Login $14
Hacked Western Union Account $45
Verified Stripe account with payment gateway $1,000
Payment processors have become more and more prevalent as retailers accept mobile pay and other forms of online payment. These payment processors vary in cybersecurity capabilities and insurance, so the value of a hacked account is likely to fluctuate as a result.
Example of stolen banking and payment processing information being sold on the dark web:
Bank Logins Dark Web
Crypto Accounts
Hacked crypto accounts seem to be one of the most valuable items for purchase. Due to the skyrocketing prices of BTC and other cryptocurrencies, hacked accounts may hold large sums of coin-based currency and cash, protected by relaxed security measures after the initial verification process.
The high-value accounts matched with abundant BTC ATMs for anonymous cash-out make crypto accounts a very valuable item for hackers.
Crypto $Avg. Price USD (2021)
Hacked Coinbase verified account $610
USA verified LocalBitcoins account $350
Crypto.com verified account $300
Coinfield.com verified account $410
Kraken verified account $810
Cex.io verified account $710
Blockchain.com verified account $310
Binance verified account $410
Example listings of hacked cryptocurrency site accounts being sold:
Dark Web Crypto Accounts
Social Media
Whether it’s the increased supply of hacked information or the diminishing value of an individual hacked account, prices for hacked social media accounts seem to be dropping across all platforms. Additionally, offers to hack specific accounts or sell them were relatively scarce, but there were still some.
Given the recent increase in security measures (e.g., MFA, account locks on too many attempted passwords) implemented by social media platforms, hackers must resort to social engineering techniques to gain login credentials, which is a very labor intensive endeavor for a relatively low success ratio.
Also worth noting, the extremely low cost of social engagement (e.g., likes and follows). This just proves how easy it is for some to gain influence through social proof with just a few bucks.
Updated Pricing (Oct. 2020 to Feb. 2021)
Social Media Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Hacked Facebook account $75 $65 -$10
Hacked Instagram account $55 $45 -$10
Hacked Twitter account $49 $35 -$14
Hacked Gmail account $156 $80 -$76
Instagram followers x 1000 $7 $5 -$2
Spotify followers x 1000 $3 $2 -$1
Twitch followers x 1000 $6 $5 -$1
LinkedIn x 1000 $10 $12 +$2
Pinterest followers x 1000 $5 $4 -$1
Soundcloud plays x 1000 $1 $1 $0
Twitter retweets x 1000 $25 $25 $0
Instagram likes x 1000 $6 $5 -$1
Example of hacked social media accounts for sale:
Dark Web Social Media
Hacked Services
Vendors even sell access to paid online subscription services at lower prices for those willing to take the risk.
Hacked Services Avg. Price USD (2021)
Uber driver hacked account $14
Uber hacked account $8
ZipCar account $12
Bet365 account $50
Lykke account $260
FedEx account $22+
Netflix account – 1 year subscription $44
Kaspersky account $8
Various adult site accounts $5
Canva Pro yearly $6
NBA League Pass $8
Orange TV $4
Hulu $5
The Telegraph UK Premium $7
CNBC Pro $3
Netflix 4K 1 year $4
HBO $4
Ancestry.com $8
Adobe Creative Cloud 1 year $160
eBay account with good reputation (1,000+ feedback) $1,000
Examples of various hacked online accounts being sold:
Dark Web Hacked Services
Forged Documents - Scans and Physical
Forged documents are available as digital scans or as physical documents. Depending on the vendor, they are highly customizable and can be made with any details that the buyer wants, so with just a few pieces of real information, a criminal could create an entire file of forged official-looking documents.
Document scans with selfie is another valuable purchase as they can be used for SIM swap attacks as well as personal data access requests in California and in the EU.
Besides the documents listed in the table below, counterfeit money is also extremely prevalent, mainly in denominations of 20 or 50 USD. We found USD, EUR, GBP, CAD, AUD were the most common, and some came with a UV pen test guarantee. The reported “high-quality” counterfeit banknotes typically cost around 30% of the banknote value.
Document Scans Avg. Price USD (2021)
Alberta CA Drivers License (scan) $32
Minnesota drivers license $20
Utility Bill templates $39+
US Business cheque templates $15
NSW (Australia) drivers license $20
Russian passport scan $100
New York drivers license $80
USA selfie with holding ID $100
US valid social security number $2
Example listings of fake documents being sold on the dark web (digital form):
Fake Documents Dark Web - Scans
Physical forged documents are also being sold. These are the highest priced items on the dark web markets by far.
Physical Documents Avg. Price USD (2021)
Fake US Green Card $150
New Jersey ID $50
Netherlands Passport $4,000
Poland Passport $4,000
Indiana ID $185
Texas ID $145
Utah ID $160
European Union National ID (avg.) $120
Latvian National ID $500
Louisiana ID $125
Montana ID $150
Nevada ID $160
Delaware ID $185
France Passport $4,000
Lithuanian passport $1,500
Maltese Passport $6,500
Maltese Passport $6,500
Various European Union passports $4,000
US driver’s license $100
Example listings of forged documents being sold on the dark web (physical form):
Dark Web Forged Passports
Email Database Dumps
Email dumps are very common and notoriously inexpensive due to their mainstream availability and low accuracy. Most email dumps are aggregations and collections of other email breaches.
Email Dumps Avg. Price USD (2021)
Fake US Green Card $150
600k New Zealand emails $10
350k Czech emails $10
2,4 million Canada emails $10
4,78 million Mexico emails $10
380k Austria emails $10
Private USA dentists database 122k $50
USA Voter Database (various states) $100
Example listings email database dumps being sold:
Dark Web Emails
Malware
Once installed on compromised systems (e.g., Windows, Android and others), malware gives hackers full access to the machine, which can be used to hijack computer resources via ransomware or to steal information about the user.
Common ways of implementing the malware is via fake online casinos, FB/social networks, warez websites etc. so beware downloading anything from untrusted sites and sources.
For every 1,000 installs, hackers stand to steal tens of thousands of dollars.
Updated Pricing (Oct. 2020 to Feb. 2021)
Malware Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Global low quality, slow speed, low success rate x 1000 $70 $50 -$20
Europe low quality, slow speed, low success rate x 1000 $300 $320 +$20
USA, CA, UK, AU low quality, slow speed, low success rate x 1000 $800 $900 +$100
Global med quality, 70% success rate x 1000 $80 $80 –
Europe med quality, 70% success rate x 1000 $700 $500 -$200
USA only med quality, 70% success rate x 1000 $900 $1,000 +$100
USA, CA, UK, AU med quality, 70% success rate x 1000 $1,300 $1,400 +$100
Europe fresh high quality x 1000 $2,300 $2,500 +$200
Europe aged high quality x 1000 $1,400 $1,200 -$200
USA high quality x 1000 $1,700 $1,900 +$200
CA high quality x 1000 $1,500 $1,400 -$100
UK high quality x 1000 $2,000 $2,200 +$200
Android x 1000 $600 $900 +$300
Premium x 1000 $6,000 $5,000 -$1,000
Example listings of malware being sold on the dark web:
Dark Web Malware
DDOS Attacks
A distributed denial of service (DDoS) attack sends the target website thousands of connection requests per second to overload and crash the website’s server, thereby taking a website offline. Typically, no information is stolen through these attacks, but they are used to dox a website or cover up other hacking activities.
Updated Pricing (Oct. 2020 to Feb. 2021)
DDOS Attacks Avg. Price USD (2020) Avg. Price USD (2021) YoY Difference
Unprotected website, 10-50k requests per second, 1 hour $10 $15 +$5
Unprotected website, 10-50k requests per second, 24 hours $60 $50 -$10
Unprotected website, 10-50k requests per second, 1 week $400 $500 +$100
Unprotected website, 10-50k requests per second, 1 month $800 $1,000 +$200
Premium protected website, 20-50k requests per second, multiple elite proxies, 24 hours $200 $200 –
Why This Data is Important
Dark web market data may not provide the average person with useful insights, but what they do provide is a powerful perspective into just how valuable your personal data really is, and how cheap it is to exploit you.
We’ve heard all the horror stories of unsuspecting victims losing their life savings or hackers selling cam footage on the deepest corners of the web, but it’s easy to think it will never happen to you. The sad truth is with the growing supply of personal information on the dark web, the likelihood and occurrence of devastating hacks increases every day.
The reality is that hackers rarely resort to targeting specific people. With the sheer quantity of data available for purchase, they just need to play the numbers game, and if you don’t protect yourself, you’ll be the one paying the price. By adopting a few, simple rules and habits, you’ll make it harder for hackers to get your data, and in doing so take yourself completely out of their crosshairs. Like we said, it’s just a numbers game.
How to Protect Yourself From Identity Theft
By following the below recommendations, you will be much more likely to avoid identity theft.
Avoid Public Wifi
Avoid public or unsecured WiFi. If you must log into an account on a network you don’t trust like at a coffee shop, use a VPN to encrypt all communications. If an attacker has admin access to the network you’re using, they can manipulate everything you’re doing and even forge bank websites.
Use Safe ATM Practices
Check for ATM skimmers. Skimmers are devices placed over an ATM (often exact replicas of the card reader) to read a card and send your information to a hacker. To check for skimmers, you should:
Press around the sides of the card slot and see if anything feels loose, they’re delicately mounted so they’ll move when pressed with a small amount of pressure.
Check for glue around the edges or tape. If you see any glue material, stay away from that ATM and call the bank.
If you have difficulty putting your card into the machine, stop trying and report it to the bank.
Check for fake keypads. Fake keypads are sometimes placed over the legitimate one to record your PIN number. They’re also often very loosely mounted. If it jiggles around a bit or if you notice the keypad is off-center, you should avoid using it.
Keep your Information Private
Avoid giving sensitive information over the phone to anyone, regardless of whether it is a requirement for some process. If possible, do it in person. And be sure to verify who you are talking to is who they say.
Use Anti-Malware Tools
Use anti-malware software such as AVG on your personal computer to check for malware, and make sure it’s set to automatically update.
Use Account & Password Hygiene
Never use the same password for multiple accounts. This is the easiest way for an attacker to gain access to your accounts. When a major list of account details is dumped on the dark web, your account details can be checked against other services such as email or banking, and you really don’t want them to have the same password.
Delete accounts you don’t use anymore. Old accounts can be compromised and used for password resets or similar attacks. However, if you don’t reuse passwords on multiple accounts, this is not really an issue.
Use a password manager such as LastPass or Keepass (both free) so you can have super strong password security for your accounts, and only need to remember one master password.
These rules may feel a bit complicated and burdensome, but once you get used to following them, they’ll become second nature. You develop a sense of cybersecurity that is vital online and in daily life.
These habits may seem burdensome, but over time it will become second-nature. In the end, you will be doing your part in protecting your digital identity and safeguarding your own future.
