Stolen credit card data, bank account credentials, and cryptocurrency accounts continue to command significant prices in criminal marketplaces, providing an unusual window into the economics of financial fraud. Rising prices for compromised financial data could reflect several factors, including greater risks for criminals, higher-quality stolen information, and potentially reduced availability as organizations strengthen their data security.
Improved security, however, is only part of the solution. Broader adoption of multifactor authentication could make stolen credentials significantly less useful by preventing criminals from accessing accounts with compromised login information alone. Reducing both the availability and value of stolen financial data could make it more difficult and expensive for fraudsters to monetize compromised credentials.
This article discusses the increased value associated with stolen data for credit cards and bank and crypto accounts. Pricing is interesting as an indicator of market forces in the criminal world and while the article provides a different reason for the price hikes I prefer to believe the increased prices are a sign of reduced inventory driven by improved data security measures.
Now if only multifactor authentication were more broadly adopted we might attack that inventory by making the data that did get released into the wild less valuable. I can only hope:
“The price hikes are due to a combination of factors, including the increased risk criminals face in obtaining the data, the improved quality and accuracy of the card data, and inflation, says PrivacyAffairs.com. To entice buyers, sellers of stolen card data will typically guarantee that 80% of data sold is accurate, the report says.
Stolen online-banking logins for accounts with a minimum balance of $2,000 sell for $120 per account, up $55 from 2020. A cloned Mastercard card with a PIN sells for $25 per account, a $10 increase from 2020, while a Walmart account with a credit card attached sells for $14, a $4 dollar increase. Credit card data for an account with a credit line up to $1,000 saw a $3 increase to $15. Prices for cloned American Express and Visa cards with PINs, which sell for $35 and $25 respectively, remained flat.
Among the new card products tracked by PrivacyAffairs.com, hacked card accounts with card-verification values from Israel sell for $65 per account, while card account data with CVV numbers for the United States sell for $17. “You can see that USA hacked credit card details are valued the lowest (due to high supply), and Israel the highest,” the report says.”
The market for stolen credit card data demonstrates how cybercriminals assign value to different types of compromised financial information. Prices vary based on factors such as account balances, credit limits, geographic markets, and the completeness and reliability of the stolen credentials.
Stronger data security can help restrict the supply of compromised information, while multifactor authentication provides another layer of protection when credentials are stolen. As financial institutions and merchants strengthen authentication and fraud prevention measures, making stolen data harder to obtain—and less useful once obtained—could significantly disrupt the economics that support financial cybercrime.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
