As well as the web everyone knows, there is the "dark web" (sometimes called "deep web"). It's accessible only to savvy computer users and is a hotbed of illegal activity, from stolen credit card information to weapons and drugs.Recently, government agencies have taken notice. In 2013, the FBI shut down Silk Road, the biggest marketplace for online criminal activity. But, with Silk Road gone, a number of smaller marketplaces have popped up to try and take its place.
As experts in e-commerce fraud, Trustev researchers regularly look into the marketplace for stolen credit card information and how fraudsters distribute stolen financial information among themselves. Our researchers provided us with screenshots of these marketplaces to show us how criminals can access these sites, how they work, and what kind of stolen credit card data and illicit items are available.
Note: we did not purchase items on these sites, as many of them are illegal in the US and EU. We blurred out usernames, brands, and site URLs to reduce the publicity the websites gain.
Accessing & signing up
This is the homepage for the Tor Network, which acts as a portal for the dark web. You need to jump through a few more hoops before you can access the marketplaces, however.
The sign up pages for these marketplaces in the deep web are pretty simple. Here’s the signup page for [redacted]:
Here’s the search page for a marketplace called [redacted], which is eerily similar to Google's. As you can see, the website suggests you start off with “cannabis” and has an “I’m Feeling Lucky” button.
Here’s the landing page for a marketplace called [redacted]. You can purchase a wide ranging selection of goods, ranging from simple lab equipment to weapons, drugs, fraud information, and counterfeits.
The search results page for [redacted] is interesting. Users can purchase valid CVV and debit card information for Visa cards, and in the category section to the left, it shows that you can also purchase credit card dumps (which is the information stored in the magnetic stripe, which includes account info, names, billing information, and phone numbers), documents and data, account information, and credit card and CVV numbers.
Here’s an example of what a search results page looks like in [redacted]. You can make a number of payment related purchases, including buying fake prepaid cards and counterfeit 50€ bills.
What you can buy
If you really hate paying for Spotify Premium, you can purchase lifetime subscription from the deep web for a number of accounts -- $3.99 for just one subscription and up to $99.99 for 100 lifetime subscriptions.
Using these marketplaces, you can download FraudFox, which is an application that changes how your browser settings and information appear to the websites you visit. Fraudsters use this type of application to try to bypass fraud detection systems:
At one marketplace, fraudsters can make social security cards, credit cards, and state licenses -- all which cost below $20:
Here is an example of hospital employee badge available online. Needless to say, this could be extremely dangerous if it falls into the wrong hands. It’s available for about $11:
A fake NYPD detective badge could be even more dangerous. Buyers can put any image into the ID badge. It also costs around $11:
Some deep web users may not be that knowledgeable on how to commit fraud. A quick search shows that there are guides that outline, step by step, on how to conduct fraud and not get caught. They range from stealing money from ATM’s, exploiting loopholes within online casino’s for “constant cash,” directly obtaining ATM or credit card PIN codes, to how to commit credit card fraud and how to defraud Amazon.
Note: Trustev does not endorse any of these sites! We visit them for research purposes, and we published this to make people aware of how much illegally obtained data is for sale, at low prices. We encourage consumers to be vigilant about their identities, and monitor all activity about credit card use and account signups. A little monitoring goes a long way toward avoiding the pain and hassle of identity theft.