The Data Brokers

Fraud begins with facts about you. It is easy and inexpensive to buy in an underground market.

Information is like the electricity that keeps the fraud business going. Scammers can't reach you or pretend to be you if they don't have your name, email address, Social Security number, password, credit card information, or other personal information.

So, a huge illegal underground economy has grown up around the world to meet the needs of scammers. The goods? Law enforcement and cybersecurity experts at the company Digital Shadows say that more than 15 billion pieces of personal information have been stolen. That seems like a lot of information, but it's not. Digital Shadows says that the average person logs in to nearly 200 sites that need passwords or other information. There are a lot of personal details about you on your computer that a scammer might find useful. So, another illegal business is always going: stealing data. The Identity Theft Resource Center says that large organizations' customer databases were broken into a record 1,862 times last year. Most of that information is bought and sold on this dark web market.

If this information marketplace were a mall, most of the people you'd find there would be hackers who steal information and sell it in bulk, malicious code writers who help hackers get into your computer by infecting it with malware, and vendors who buy the stolen information, repackage it, and sell it to "end users" who are actually trying to trick you.

How much do scammers value your personally identifiable information (PII)? "It's really only worth about $2," says James E. Lee, chief operating officer of the non-profit Identity Theft Resource Center in San Diego. Many people think that their nine-digit Social Security number is the most important way to identify them.

A cybersecurity expert who runs the website KrebsOnSecurity.com says that a Social Security number with a name and date of birth costs $4 or $5, or about "the price of a caramel macchiato."

Lee says that a person's credit card information is worth between $25 and $35 more. A hacked Facebook account can bring $65 and a selfie with a U.S. driver's license can bring $100. Who's going to pay for this information?

Robert Villanueva, a former U.S. Secret Service supervisor who is now the executive vice president of Q6 Cyber in Hollywood, Florida, says that there are hundreds of thousands of serious "threat actors" all over the world.

This personal information is sold in "shops" on the dark web and in "forums" that only the most skilled cybercriminals can access, says Villanueva.

Malware, or bad software, is a key part of their crimes. If a computer is infected with something called a "keylogger," the bad guys can see every letter a person types. This lets them steal banking and email passwords and take over the accounts.

The same goes for your phone. "Threat actors are really going after people's phone numbers to take over their digital lives, because that's the weakest link," Krebs says.

~credits by Katherine Skiba