Stolen Identity Valuation and Market Evolution on the Dark Web

This study explores the valuation of stolen identities available for retail sale on dark web marketplaces. All listings on the five major dark web marketplaces offering full stolen identities, of “fullz”, were tabulated and manually coded. The research showed that targeted marketing and value-added services are being used by criminals to differentiate their offerings, with basic identity information becoming a commodity with pricing as low as 250 identities for $1. With the proliferation of data breaches, the concept of “first sale” for identities has evolved and is changing to a “first use for purpose” model.  Traditional authentication mechanisms, such as social security number and mother’s maiden name, are ineffective and no longer viable for most purposes. Enhanced authentication mechanisms to combat identity theft such as requiring scans of driver’s licenses or passports or asking background questions from credit reports are becoming ineffective as new identities for sale offer these enhancements.