The first time I performed a somehow deep research on the black market was back in 2007. At that time, most of it was about selling-buying Trojans, infection kits, and of course stolen data, such as bank and credit card details stolen from users around the world.
A few years later I thought it was time to find out how this market had evolved, and today we have released a report with all our findings.
Credit card details can be purchased for as little as $2 per card, but this level does not provide additional information or verification of the account balance available. If the buyer wants a guarantee for the available credit line or bank balance, the price increases to $80 for smaller bank balances and upwards of $700 to access accounts with a guaranteed balance of $82,000.
Prices are higher if the accounts have a history of online shopping or use payment platforms such as PayPal. For a simple account without a guaranteed balance, we found prices starting at $10 and increasing to $1,500 depending on the platform and the guarantee of available funds. Similarly, these cyber-criminals also offer cloned credit/debit cards (from $180), card cloning machines ($200-1,000), and even fake ATM machines (from $3,500 depending on the model). Additional products such as money laundering services (bank transfers or cashing checks) are available for a commission ranging from 10 to 40 percent of the operation. If buyers want to use stolen bank details to buy products online, but are wary of being traced through the delivery address, the cyber-criminals will make the purchase and forward the goods for a fee of between $30 and $300 (depending on the chosen product).
For more sophisticated cyber-criminals who want to set up their own fake online stores and use rogueware techniques to obtain both user details and also reap the money these unsuspecting victims pay for fake antivirus products, there are also teams available to deliver turnkey projects, design, develop and publish the complete store, even positioning it in search engines. In this case, the price depends on the project.
Prices for botnet rental for sending spam (using bot-infected zombie computers, for example) vary depending on the number of computers used and the frequency of the spam, or the rental period. Prices start at $15 and rise to $20 for the rental of a SMTP server or VPN to guarantee anonymity.
Following is a summary of the products available and their prices:
| Products | Price |
| Credit card details
Physical credit cards Card cloners Fake ATMs Bank credentials Money laundering
Online stores and pay platforms Design and publishing of fake online stores Purchase and forwarding of products Spam rental SMTP rental VPN rental |
From $2-90
From $180 + cost of details From $200-1000 From $3,500 From $80-700 (with guaranteed balance) From 10 to 40 percent of the total $10 for simple accounts without guaranteed balance From $80-1500 with guaranteed balance According to the project (not specified) From $30-300 (depending on the project) From $15 From $20 or $40 for three months $20 for three months
|
This cyber-criminal black market caters to buyers’ needs just as any other business, and functions in similar ways. Since there is a great deal of competition in this industry, the rule of supply and demand ensures that prices are competitive, and operators even offer bulk discounts to higher-volume buyers. They will offer free ‘trial’ access to stolen bank or credit card details, as well as money back guarantees and free exchanges.
However, since it is a black market, there are clearly many areas that differ from traditional business. Since anonymity is of the utmost importance, many sellers use underground forums to keep out of sight. Their offices are effectively the Internet, though they even go as far as advertising their ‘office hours.’ Some are more brazen about their activities, and have accounts on Facebook and Twitter which they use as shop windows. To ensure anonymity, contact is always made across instant messaging applications or free, generic email accounts.
Once contact is made, the transaction can be executed directly or through a website set up by the seller, using a username and password, which as with any online store, allows buyers to browse and fill their “shopping cart.” Payment is always made up-front using services such as Western Union, Liberty Reserve and WebMoney.
You can get the full report at: https://press.pandasecurity.com/press-room/reports/#monographs