Darknet Market Price Index: 2019 Report

We extended our analysis this year from three to five of the biggest black markets on the dark web, making this edition of the Darknet Market Price Index the most comprehensive yet.

Read all our research reports on the darknet trade in hacked personal data

Our analysis of the trade in stolen online credentials and personal data revealed individual hacked accounts for brands with recent privacy or security woes have become significantly more appealing to fraudsters.

Despite these individual price increases, we found the value of someone’s entire online identity remained around the $1,200 mark. For UK residents it was a little less at around £800.

Also steadily increasing value to cybercriminals were accounts for online services which have become a part of everyday life in recent years, such as Netflix and Uber, which along with gaming phenomenon Fortnite all sell for around $11 each on the dark web.

Hacked Accounts: Notable Findings

The following table pulls out some of the most notable prices for accounts that a resident of the US or the UK might expect to have.

_{Individual accounts marked with US or UK are based on data applicable to that country only, otherwise prices in GBP have been converted from USD at the FX rate at the writing, $1.31.}

_{Price change is difference in average price between 2018 and 2019, where 2018 data is available.}

Jump to full Price Index

With a horror year receding in the rearview mirror, hacked Facebook accounts have almost doubled in value since this time last year to just over $9 (or around £7) after falling out of favor following the data breach affecting 50 million accounts. Stolen Amazon credentials have also rocketed in value, worth over three times as much year-over-year at $30 (or around £14.50 for UK accounts) to be the most valuable brand on the dark web.

It’s not surprising that stolen financial account details remain a mainstay on the dark net markets and typically command the highest prices – especially high-balance bank account and debit card details, which change hands for close to $260. For UK bank accounts, prices are even higher at almost £348.

However, the trade in entertainment accounts with less immediately obvious value for identity thieves continues to flourish. Accounts for games and streaming services including Spotify, Tidal, Steam and Minecraft typically sell for less than $4 (or sub-£3), cheaper than a Big Mac.

The average person has dozens of accounts which form their online identity, all of which can be hacked and sold. Our team of security experts reviewed tens of thousands of listings across five of the most popular dark net markets – Dream, Wallstreet, Empire, Berlusconi and Tochka Free. These sites deliberately obscure themselves from the public and can only be accessed through the Tor browser, preferably also with a Tor-optimized VPN for added security. They are often used to buy and sell personal data, along with other contraband including weapons and illicit drugs.

We focused on listings featuring stolen ID, personal data and hacked accounts for this update to the Darknet Market Price Index. We excluded massive data ‘dumps’ to avoid distorting average prices, as individual accounts in these dumps equate to tiny fractions of a cent each. Our analysis has shown that it would cost only $1,250 to buy up the entire identity of someone in the US, assuming that they had all the accounts listed. In the UK, that figure is around £800.

Why did we publish this research? By showing how much fraudsters are willing to pay for stolen credentials, our goal is to raise awareness about the value of our personal data. We hope this will lead to a rise in standards of day-to-day personal information security for the average internet user.

UPDATE Jun 2019: we published a follow-up to the full 2019 report that focused on UK data. Jump straight to those findings.

US Data

The following table shows average prices for US stolen ID, personal data and hacked accounts for sale on the darknet markets. It’s ordered by category, most valuable to least valuable.

UK Data

The following table shows average prices for UK stolen ID, personal data and hacked accounts for sale on the dark web. It’s ordered by category, most valuable to least valuable.

This June 2019 update of the Price Index comes at a unique time, following the takedown of two major darknet markets in quick succession by the authorities and a sharp spike in prices.

In order to assess the potential impact of this on consumers, we have reviewed a selection of the most important hacked log-ins and accounts to track their changing value to identity thieves.

Alarmingly, the prices have increased on average by almost three times compared to the start of the year, meaning that someone’s entire identity could potentially now be worth £2,400, up from around £800 at the start of the year.

Stolen consumer data is more lucrative for hackers and cybercriminals than ever before. This should serve as notice for everyone to be on their guard against identity theft, or risk becoming a victim.

Notable price surges include Airbnb (£20), Facebook (£14) and PayPal (£84.50) due to the sheer scope of potential fraud that can be committed by scammers in possession of these accounts.

Darknet Markets Price Index

Stolen ID, personal data and hacked accounts for sale

Analysis

In this section we explore what’s behind pricing movements. For more information about how these accounts are used in fraud, read about Common Scams.

The value of bank accounts on the darknet markets has almost tripled in just six months. This increase is likely driven by a range of factors. The fall of two big markets in such a short time, along with the likely subsequent arrest of key vendors, has caused a major – if temporary – reduction in easy availability of all accounts. Those sellers still active can therefore charge a premium.

We are also seeing in increase in listings that not only offer online banking credentials and relevant personal information but also full packages including debit cards, PINs, and for mobile banking services such as Monese, a burner phone and SIM to access them.

We are also currently seeing more hacked bank accounts for sale that have high balances, giving criminals access to thousands of pounds instantly.

Hacked credit cards are the bread and butter of the dark web economy in stolen data and prices remain stable at around £33 per account. Our data focuses solely on genuinely hacked accounts, as opposed to fraudulently-opened new credit cards using stolen identities.

Debit cards are similarly priced at around £46. The higher value is because it’s easier to realize the value of debit cards into cash, and because accounts with high balances are being put up for sale more often.

Paypal has long been a favorite for online fraud. The recent surge in pricing for these accounts to around £84.50 each is likely due to the squeeze in supply caused by the disappearance of two major darknet markets, along with the growth of PayPal Credit.

Hacked PayPal personal and business accounts can be used to set up PayPal Credit accounts with high credit limits, which are then either drained or sold on for a huge profit. PayPal Credit accounts with high limits in the tens of thousands that have been created in this way sell for an average of £3,000, and as much as £12,000 each.

Genuine physical identity documents, such as passports and drivers licenses, are incredibly valuable for identity theft. Stolen documents of this nature – intercepted in the mail, for example, or stolen and sold to criminals by corrupt officials – fetch very high prices. UK passports, marriage and birth certificates all trade for around £2,000, but can fetch as much as £5,000.

Passport scans sell for only a fraction of the price due to their digital nature and the greater risk of not being accepted. They are typically sold in batches of ten scans or more for around £22 each.

In the travel category, prices for British Airways accounts have increased since the mega breach the airline suffered last year, where the payment and passport details of 380,000 customers were stolen.^[6] The value of accounts increase in line with the total number of air miles available. Double the points typically equals double the price tag. The current rate is just 18p per 100 air miles.

Prices for hijacked Facebook accounts continue to enjoy a resurgence as it becomes increasingly clear that the platform’s 2.38 billion users aren’t abandoning it any time soon, despite the scandals that have rocked the social media giant.

As with Facebook, Netflix and Spotify log-ins offer a route into potential identity theft. An added bonus is that opportunistic criminals can also stream TV shows and movies and music for free, at least until the true owner notices their account has been compromised.

The continued growth in the value of streaming accounts reflects just how ubiquitous they have become.

Similarly, accounts for news sites like The Times and The Economist give the buyers access to high-quality media that’s otherwise locked behind a paywall. Prices have increased significantly in a short space of time, suggesting that there is strong demand for these accounts – although it does remain a niche offering on the darknet markets.

Looking to online retail, stolen accounts for budget supermarket Morrison’s (£16) are actually more expensive than those of its more upmarket competitors due to the potential for exploiting its rewards system.

This is four times the cost of high-end grocer Ocado (£4) for example, while Tesco accounts are least appealing, priced at less than a £1 each.

Given that pricing reflects demand, Ocado and Tesco accounts have proven less profitable for scammers in the past, likely due to better security, less lucrative rewards schemes or fewer vulnerable stored payment methods.

Hacked email accounts tend to be sold either in massive dumps from large scale data breaches or as small batches of, or even individual, verified emails.

Unit prices on the dumps work out at tiny fractions of a penny each to account for the risk that most won’t be accessible or even valid.

Verified emails, such as Yahoo and Gmail, on the other hand, trade for a few pounds each. The increasing adoption of two-factor authentication keeps overall prices relatively low.