Identity Trafficking on the Dark Web

How much do you think the average identity thief knows about you? In this era of online everything, they may know more than you think. Between stolen personal information for sale on the dark web and data being leaked in the deep web, criminals can find out enough to take over everything from your financial accounts to your healthcare. Here’s how that happens and what you can do if your personal information goes up for sale on the dark web and makes it into the wrong hands.​

Different identity thieves specialize in different kinds of crimes. Some focus on scams such as credential stuffing, aiming to quickly steal a little from a lot of people. Others go deep, gathering a lot of information around a few identities, so they can steal more money from each person, typically over longer periods of time. And this more complex scam doesn’t take much intellect or creativity. In fact, a single Google search can provide an online manual for building a theft-ready identity. ​

Here’s how it works:

1. First, a black-market vendor creates a “fullz”, a full set of personal information related to an account, and lists it for sale on the dark web. The information in a fullz can come from a large-scale data breach or the black-market vendor may start with a name and account number and assemble more information by running online background checks on the victim. At minimum, a fullz will include the victim’s full name and billing address, Social Security number, date of birth (DOB), and account information such as a credit card number, expiration date, and card security code or a medical group number and patient ID. The more personal information, the higher the cost of the fullz.
2. Next, a criminal buys a set of fullz from a black-market website, then goes through the list to identify the best targets for identity theft. Accounts with high credit limits are preferred targets, as are seniors (who often have good credit and usually haven’t set up automatic alerts) and children (who often have no one monitoring their credit reports or identities). For adult targets, the criminal uses names, addresses, and DOBs from the fullz to run more comprehensive (hence, more expensive) background checks that reveal relatives, previous addresses and phone numbers, education, loan history, social media accounts, etc., all compiled from public sources.
3. Armed with comprehensive information on a victim, the thief is ready to answer security questions during account takeover fraud, change addresses and contact information on an account, provide correct background information for fraudulent loan applications, and find other potential ways to exploit the identity. Criminals who specialize in this kind of theft can keep exploiting an identity for years, often working multiple frauds at a time, and when one is discovered, they just start another to take its place.

While you can’t prevent data breaches or control how your personal information comes up in a background check, you can take steps to protect yourself from these targeted frauds. You can change passwords frequently, freeze your credit, and set up alerts and two-factor authentication for as many accounts as possible. And now, you can use dark web monitoring to see when your personal information is leaked or comes up for sale on the dark web. Click here to try CyberScan^TM, the latest addition to the MyIDCare platform by ID Experts. It will scan over 14 billion records across open web sources, underground forums, black markets, and remote corners of the deep and dark web, telling you what information has been exposed. The verified results will tell you what passwords to change immediately and which accounts you need to watch most closely. ​

The more thieves know about you, the more they could steal. But the more you know about what they know, the better the chance you have to stop them in their tracks.