How Thieves Convert Your Identity into Cash on the Dark Web

​In a recent article, we talked about how “fullz”, comprehensive stolen identities, are assembled by criminals and sold on the dark web for a few hundred dollars each. But even logins for online services such as Airbnb or GrubHub can provide more than enough opportunity for theft. In fact, according to a recent NBC news report, the average internet user’s identity is worth about $1,200 to hackers. Why so much? Because stolen identities can be reused in many ways.

It’s pretty obvious why a fullz is so valuable to a criminal. With so much information, the buyer can open new accounts or take over existing accounts and simply change the contact information, so the owner doesn’t realize what’s happening until it’s too late. But what happens when smaller sets of stolen personal information get exploited? Real social security numbers may be combined with fake or unrelated names, addresses, and birthdates to create synthetic identities, which can be used to open new accounts, or they may be sold to people who are in the U.S. illegally or who need a fake identity for criminal purposes. Usernames and passwords for services such as Airbnb, Uber, or Grubhub sell for less than $10 on digital black markets. But criminals can use them to steal the host’s or driver’s earnings by diverting payments, or a highly rated Airbnb guest account can be used to book time in a luxury property in order to commit burglary.

Stolen identities are also a long-term investment for a criminal. An identity can be sold multiple times, and a buyer can use the stolen information to commit multiple kinds of fraud over a number of years. A 2017 Javelin Strategy and Research presentation reported that the amount of fraud committed based on 2- to 6-year-old breach data had increased by nearly 400% over four years, reaching $3.7B in 2016. And a recent AARP article tells the story of a woman who has been a victim of repeated identity fraud for 17 years. In fact, her information has been bought and sold so many times that the U.S. Department of Justice advised her to change her Social Security Number… an extreme measure that is normally not recommended!

There are so many ways criminals can exploit your identity, no single action is enough. You need to protect yourself in multiple ways:

• Credit freezes are important but won’t protect against synthetic identity theft or criminal identity theft.
• Credit monitoring is useful, but problems show up in credit reports only after the fact.
• More comprehensive dark web monitoring, such as ID Experts’ CyberScan^TM, can send you alerts when your information becomes available to thieves, so that you can head off trouble by changing passwords, setting up multi-factor authentication, and paying special attention to the accounts most at risk.
• Identity recovery services such as MyIDCare can help you combat fraud quickly and effectively if criminals do get past your best defenses.

It’s sad that criminals have become so versatile and so adept at exploiting our online identities. The good news is that protection against ID fraud is now online, too, and it’s as close as an app or your browser.