After any kind of data breach or hacking event, there are a handful of possibilities for what criminals will do with your stolen information. The outcome typically depends on what types of data they were able to steal, but possibilities include holding it for ransom to prove to a company that they were hacked, using it themselves for identity theft and fraud, or selling your records on the Dark Web to others who would use it.
Considering the heavy emotional and financial toll that identity theft can have on its victims, it’s shocking how little a consumer’s record can sell for on this internet black market. Recent studies have shown just how much money your life is worth to a scammer.
1. Credit card or debit card information – Hackers used to actively seek out credit and debit card numbers, as well as any PIN numbers or security codes associated with those cards. Due to better fraud detection and things like “card not present” transaction alerts from financial institutions, it’s easier than ever to spot criminal use of someone’s card and cancel that account. That could be why card account logins only fetch a few dollars. According to McAfee’s recent findings, a card number with the CVV2 code from the back is worth between $5-$8 dollars, but if it also comes with the bank’s ID number, it could go for $15 online. If the stolen credentials included something called “fullz,” that is, the card owner’s complete information, that would be worth around $30.
2. Online Payment Service Account Information – Whether it’s your own bank account that you can access and use online or a payment service like PayPal, there’s an interesting finding of the value of these stolen logins: the higher your available balance, the more money the criminal pays to purchase it from the original thief. For example, McAfee’s “The Hidden Data Economy” found:
$400-$1000 Balance is worth $20-$50
$1000-$2500 Balance is worth $50-$120
$2500-$5000 Balance is worth $120-$200
$5000-$8000 Balance is worth $200-$300
3. Medical Identities – When people think of identity theft, they tend to overlook their medical identities. This is the information contained in your medical records, such as your name, address, Social Security number, health insurance ID number, prescription medications, or other necessary information. A study by NPR found that a group of ten Medicare numbers will fetch about $4700 online; it’s important to remember that Medicare numbers—unlike most health insurance numbers now—are still currently the member’s Social Security number, which can make the stolen profiles doubly valuable.
But what about a typical case of stolen identities where the victim’s name, address, phone number, birth date, Social Security number, and other details are just thrown onto the black market for someone to steal? They go for about twenty dollars each at the current market prices.
Interestingly, selling a stolen set of “fullz” online isn’t a one-and-done proposition. Once a thief has accessed someone’s complete identity, he can sell the same records to multiple customers. That means the work of recovering from the crime can feel insurmountable; you resolve one issue with a credit card someone opened up in Minnesota only to turn around and get a bill for a medical procedure in Florida. That’s why it’s important to start your recovery process with an identity theft report, and then by reaching out to agencies that can give you clear instructions on what to do next.
If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App.