A stolen payment card number costs just $7

Stolen payment cards for sale on the dark web are extremely cheap, with the price on the open market averaging only around $7.

This is according to a recent study from virtual private network service provider NordVPN, which examined the data behind 6 million stolen payment cards. It found that, worldwide, card numbers cost an average of $7. However, this is when people actually buy them. The report said that, many times, they cost nothing at all — they're given away for free as part of a bundle with other information. Over 60% of cards were sold alongside other personal information relating to the victim, such as their address, phone number, email address, date of birth, or Social Security number. This information can be used to bolster the deception, as the buyer can provide other information to those checking for fraud.

Payment card information is so cheap that the combined value of all 6 million cards examined was only around $18.5 million.

However, it should be noted that the cost is just an average. The study found that card numbers from different countries commanded different prices. Denmark had the most valuable card numbers, with the average price of a stolen Danish card being around $11.54. This was followed by cards from Japan, Portugal and Ukraine, all over $11 on average. For the U.S., stolen card numbers are actually slightly cheaper than $7 average, selling at about $6.86. The cheapest cards were from Argentina and New Zealand, with stolen numbers from there selling for less than $2.50.

"Considering the amount of damage that can be caused with stolen card data and any bundled personal information, this is a shockingly small amount, suggesting that the use of stolen cards could itself be relatively scalable even by those who have obtained the details second-hand from the dark web," said the report.

The researchers also found that most stolen cards belong to people in the US, accounting for 58.1% of the total sample. The next highest is India, which accounts for a very distant 3.7%. After this is the UK at 2.7%.

"This makes sense, considering the US has a higher rate of card penetration, a sizable population, and a strong economy. Next were India (3.7%), the UK (2.8%), and Mexico (2.6%), followed by Brazil, China, France, and Italy — a mix of countries with high populations and strong economies or political reputations," said the report.

On the other end, the report found that Russians were the least likely to have their card data stolen, which the report said "matches with the prevailing hypotheses regarding the location of large-scale hacking operations and the purposeful targeting of Anglo-European countries." It noted that China is also relatively low-risk for similar reasons, but on top of that there is also the country's lack of integration with many global information systems, as well as the generally closed off nature of the Chinese Internet.

"The cards researchers found are just the tip of the iceberg," said Adrianus Warmenhoven, a cybersecurity advisor at NordVPN. "The information sold with these cards makes it much more dangerous. In the past, experts linked payment card fraud to brute-forcing attacks — when a criminal tries to guess a payment card number and CVV to use their victim's card. However, most of the cards we found during our research were sold alongside the email and home addresses of their victims, which are impossible to brute force. We can therefore conclude that they were stolen using more sophisticated methods, such as phishing and malware."

The research fits well with another study conducted by NordVPN, which found that the average price for stolen digital data (logins and credentials, device screenshots, cookies, autofill forms, etc.) is only around $6.