The dark web is home to a vast amount of illicit markets and shops. Although there’s a variety of goods to be purchased on the dark web, one of the most sold resources by volume on the dark web, if not the most sold commodity, is stolen credit cards. Just last week, the largest carding site operator announced they would be retiring, after allegedly selling 358$ millions worth of stolen cards.
Aligned with our business, Flare collects credit card information that is for sale on various websites, in the hopes of alerting the card issuer that a credit card has been compromised, and by doing so, preventing fraudulent transactions from taking place. Focusing mostly on the North American market, for the purpose of this research, Flare has sampled the information of 500,000 credit cards.
Let’s take a look at a quick analysis of the data we’ve collected in 2021.
The Prevalence of Stolen Credit Cards in North America
First of all, of the credit card information we have collected, let’s find out which brand is the most prevalent. As a general rule of thumb, the credit card brand can be identified with the first digit of the 16 digits composing the credit card number; 3 – American Express; 4 – Visa; 5 – Mastercard; 6 – Discover.
Exhibit 1: The Most Commonly Stolen Credit Card Brands
If we compare the amount found to the reported market share by brand, we can immediately notice a correlation, there seems to be no discrimination of brands sold on the dark web. Although the smaller issuers, American Express and Discover, aren’t as prevalent as they ought to be.
Exhibit 2: Market Share By Brand
All this raises the question: how much does a credit card sold on the darkweb actually cost? The answer is surprisingly a measly $5.72 USD on average, the median price of a stolen credit card sitting at $5 USD. Considering the information sold usually consists of the credit card number, expiration date, cvv, cardholder’s name, zip code, address, and sometimes phone number, or even mother’s maiden name (MMN), date of birth (DOB), and social security number (SSN). All things considered, it may be surprising to learn you can essentially purchase a person’s identity for the price of a coffee.
As mentioned above, purchasing a stolen credit card on the dark web gives you access to a lot of information, including the zip/postal code of the credit card holder. As it so happens, some shops even provide the postal code as public information before purchasing the card.
We have compiled the zip codes of all cards for which it was available, and used the data for the following; let’s look at where the cardholders are located. Sampling 10,000 random zip codes from our dataset, we have plotted the location of American cardholders.
Exhibit 3a: Distribution of Stolen Credit Cards Across the Eastern United States
Exhibit 3b: Distribution of Stolen Credit Cards Across the Western United States
At first glance, not only can we notice that the distribution of credit card fraud victims is generally widespread, but also that our random sample follows quite closely the population density of the United States with larger concentrations around urban centers. This should come as no surprise considering most credit card theft happens through online means, and internet users are spread far and wide throughout the whole United States.
Integrate the world’s easiest to use and most comprehensive cybercrime database into your security program in 30 minutes.
The Prevalence of Stolen Credit Cards in Canada
In our sample, we have found 50,309 cards that we know to be Canadian. Unfortunately it isn’t always possible to know with authority the origin of a card, as many shops and markets do not list the country of origin. However, this doesn’t prevent us from compiling the issuing bank of all those 50,309 cards.
As for the location of Canadian cardholders, we repeated the previous exercise with zip codes and the geographical location of American cardholders, but this time using the available postal codes of Canadian residents.
Exhibit 4a: Distribution of Stolen Credit Cards Across Canada
Exhibit 4b: Distribution of Stolen Credit Cards Across Parts Of Ontario & Quebec
Looking at the actual numbers, we can identify the provinces with the most occurrences of credit card theft.
Exhibit 5: Amount Of Stolen Credit Cards Per Province
However, this raises the question of how likely credit card theft can happen, by population. Immediately, looking at the previous chart, we can notice Quebec at 9.8% of total cards found, even though Quebec represents a lot more than 9.8% of the total Canadian population. Indeed, Quebec accounts for about 22.46% of the total Canadian population. The following graph represents the amount of stolen credit cards by province, per 100,000 population.
Exhibit 6: Stolen Cards Found Per 100,000 Population by Province
For some reason, unbeknownst to us, it appears credit card theft is nearly 3 times less likely to happen in Quebec, at 57 occurrences per 100k population, compared to the 149 occurrences on a national average. Although we do have some in-house theories to explain this phenomenon, none are based on tangible evidence. If you have any idea as to why this may be the case, we’re interested in hearing it; simply drop us a line and let us know what you think!
Conclusion and how you can prevent credit card fraud
To sum it all up, it appears the stolen credit card ecosystem is a widespread issue, with criminals paying little to no attention to the origin, brand, or issuer of the credit card information they are stealing. Credit card fraud in itself is an enormous 32 billion dollars industry, and is only expected to grow in size, upwards of 38 billion dollars by 2027, according to a report by Statista.
How can you prevent credit card theft and protect your information? Flare Systems’ research team recommends; being careful with online purchases and shopping through trusted ecommerce platforms; learning to recognize phishing emails; staying on the lookout for card skimmers; monitoring your credit card transactions; and using an RFID blocking wallet, which although provides little to no tangible benefit, falls into the category of ‘you can never be too careful. Stay safe!
