Stolen credit and debit card details have been found on sale for as little as $1.50.
An investigation by the Sydney Morning Herald has found that that almost anyone on Internet can buy stolen payment card details for as little as US$1.50 a time for Aussie details, and US$2.50 a time for US and English cardholder information.
For accounts in Britain and the United States, the salesmen claim even to be able to bypass some of the latest anti-fraud protection, including Verified by Visa. Some hackers also offer free samples of the stolen data, although key information is kept hidden to preserve its resale value.
The hackers also offer a surprising level of detail about their victims, with one vendor showing a sample customer's bank account number, complete with mother's maiden name, American Social Security number, date of birth, driver's licence number and most of the 16 digits on an ATM card. Also listed were the customer's answers to security questions, such as the first name of their maternal grandmother, their favourite hobby, and the city where their mother was born.
Yuval Ben-Itzhak, chief technology officer with Finjan, said: “Our research team spotted this not inconsiderable trade in stolen payment card data back in the late spring, which we published details of in our Q2 Web Security Trends report in July.
“At that time, however, the going rate was around $15 a pop, so the rate has clearly fallen, perhaps because of the glut of this kind of data being sold on the Internet.”