The Rise of Black Market Data.(International Edition; TECHTONIC SHIFTS)

Byline: Benjamin Sutherland

Criminals who steal personal data often don't exploit it. Instead, they put it up for sale on one of the many vibrant online markets.

Los Angeles discount retailer Forever 21 announced earlier this fall that the account details for 98,930 credit and debit cards had been stolen. In August, the Best Western Hotel Group said the payment details of 8 million guests had been nabbed. Spyware-infected PCs that feed personal financial details to hackers are legion, security experts say. And e-mail "phishing" schemes that trick people into revealing financial information on bogus Web sites continue to flourish. Tales of theft abound, but where does all this stolen information go?

It goes to market. More often than not, criminals who steal data don't try to break into bank accounts or tap credit lines. Instead, they put the information up for sale on any of a constellation of vibrant online black markets, forums and chat rooms. Francois Paget, a security specialist for McAfee in Paris who works closely with law enforcement, estimates that several hundred online marketplaces are flush with newly stolen financial data. So many are popping up, Paget says, that there's a glut on the market. "It's a price war," he says.

The complete details of a bank account, including a password for online access, can be purchased often for 5 or 10 percent of the account's value. Credit-card data, by far the most heavily traded commodity, currently run about $450 per batch of 10 from the United States or Western Europe, Paget says. Premium cards of high rollers with big credit lines cost more, but accounts lacking key information, such as mothers' maiden names and billing addresses, go for as little as a dollar apiece for bulk orders, down from four dollars a year ago. Jason Franklin, a Carnegie Mellon University expert in ID-theft markets, says online offers are updated continually, so buyers "sit there and watch this market feed."

One factor driving down prices is efficiency. The marketplaces boost criminal productivity through division of labor. Instead of attempting to master a wide set of skills, crooks can perfect specialties--say, retrieving money from hijacked bank accounts--and pay others with complementary expertise. This dynamism fuels markets with surprisingly diverse offerings, from counterfeit Dutch credit cards to software that can record keystrokes on remotely hacked PCs. Visitors can get data to make fraudulent online purchases, manufacture counterfeit credit cards, transfer money out of a bank account or pull off more elaborate ID-theft scams.

Lack of trust among the criminals themselves is also depressing prices. In one forum, thought to be run by Vietnamese fraudsters, a seller of card details known as changetheworld1989 recently wrote, in broken ...