What Criminals Will Pay for You: A Price Guide to Stolen Personal Data

In legitimate commerce, consumer data fuels advertising algorithms and loyalty programs. In the underground economy, it fuels fraud, identity theft, and financial ruin. Researchers who monitor illicit marketplaces — including academic cybersecurity teams, threat-intelligence firms, and federal investigators — have documented a surprisingly disciplined pricing structure within these black-market ecosystems. The numbers are specific, the demand is consistent, and the implications for ordinary Americans are serious.

Understanding what your personal information commands in these markets is not an exercise in morbid curiosity. It is a practical risk-assessment tool. The price a criminal is willing to pay for a particular data type is a direct proxy for how much damage that data can cause — and, by extension, how aggressively you should work to protect it.

The Bottom Shelf: Payment Card Data

Credit and debit card numbers occupy the lowest rungs of the underground pricing ladder, a counterintuitive finding for many consumers who consider their card details among their most sensitive information. According to threat-intelligence reports published by firms including NordVPN and Privacy Affairs — which conduct periodic dark web price-index studies — a single stolen credit card number with its associated verification value and expiration date typically trades for somewhere between one and five dollars.

The low price reflects two economic realities. First, supply is enormous. Data breaches at retailers, restaurants, and payment processors generate tens of millions of compromised card records annually. Second, the shelf life is short. Banks and card networks have invested heavily in real-time fraud-detection systems, and most stolen cards are flagged or canceled within days of a breach becoming known. Criminals operate in a perishable-goods market, and the pricing reflects it.

Cards with higher verified balances, or those attached to premium rewards accounts, command modest premiums — sometimes reaching twenty to forty dollars — but they remain the commodity end of the stolen-data spectrum.

The Middle Market: Account Credentials and Identity Fragments

Log-in credentials for financial accounts occupy a significantly higher price tier. A verified online banking log-in with a confirmed account balance in the four-figure range can fetch anywhere from forty to two hundred dollars, according to aggregated marketplace research. The variance depends on the institution's perceived security posture and the ease with which funds can be extracted before detection.

Non-financial account credentials — streaming services, e-commerce platforms, airline loyalty programs — sell for far less, often under ten dollars, but they are purchased in bulk for credential-stuffing campaigns and account-takeover fraud. Their individual value is low; their aggregate value to a sophisticated threat actor is considerable.

Social Security numbers without accompanying documentation typically sell in the five-to-fifteen-dollar range. That figure rises sharply when the number is bundled with supporting identity fragments: a date of birth, a mother's maiden name, a current address, and a driver's license number. A so-called "fullz" package — criminal slang for a complete identity profile — can command between thirty and one hundred dollars, depending on the victim's credit profile and the freshness of the data.

The demand for fullz packages is driven primarily by synthetic identity fraud, a scheme in which criminals blend real and fabricated information to manufacture entirely new credit identities. The Federal Trade Commission has identified this as one of the fastest-growing categories of financial fraud in the United States.

The Premium Tier: Medical Records

Healthcare data commands prices that dwarf those of payment card information — a reflection of its extraordinary utility to fraudsters and its near-impossibility to invalidate. Unlike a credit card number, a person cannot simply cancel their medical history.

Individual electronic health records have been documented selling for between one hundred and one thousand dollars in underground markets, with the wide range reflecting the richness of the record's contents. A comprehensive file containing insurance policy details, prescription history, diagnostic codes, Social Security numbers, and employer information represents a multi-purpose fraud instrument. It can be used to file false insurance claims, obtain controlled substances through fraudulent prescriptions, or serve as the foundation for a full identity takeover.

The 2015 Anthem breach, which exposed nearly eighty million records, and subsequent large-scale healthcare sector compromises demonstrated the scale of criminal appetite for this category of data. Researchers at the Ponemon Institute have consistently found that the per-record cost of a healthcare data breach far exceeds that of any other industry — a figure that reflects both the regulatory consequences for breached organizations and the underlying market value of the data itself.

The Apex Predator: Biometric and Passport Data

At the highest end of the pricing spectrum sit biometric data and government-issued identity documents. Scanned passports and driver's licenses sell for between one hundred and two thousand dollars depending on the issuing country and document quality. United States passports command premium prices in international underground markets due to the travel access and identity legitimacy they confer.

Biometric data — fingerprint templates, facial-recognition vectors, iris scans — occupies an emerging and particularly alarming category. Because biometric identifiers are immutable, their compromise represents a permanent vulnerability. You can change your password. You cannot change your fingerprints. Pricing for biometric records varies widely as the market matures, but threat-intelligence analysts have documented individual biometric profiles selling for several hundred dollars, with bulk datasets attracting significant criminal investment.

The growing deployment of biometric authentication by financial institutions and government agencies has made this data increasingly valuable to threat actors seeking to defeat identity-verification systems.

What the Price Tags Actually Tell You

Read as a hierarchy, underground market pricing delivers a clear message: the data that is hardest to remediate after exposure is the data that criminals value most highly. Payment card fraud is recoverable — banks issue new cards and reverse fraudulent charges. Medical identity fraud can persist for years, corrupting insurance records and generating debt that follows victims through the healthcare system. Biometric compromise may be effectively permanent.

For American consumers, this hierarchy should directly inform personal security priorities. Freezing your credit with all three major bureaus — Equifax, Experian, and TransUnion — costs nothing and substantially reduces the utility of fullz packages to fraudsters. Monitoring your explanation-of-benefits statements for unfamiliar medical claims can surface healthcare fraud early. Treating biometric enrollment decisions with the same gravity as signing a legal document reflects the actual permanence of what you are committing.

The Market as a Mirror

Dark web pricing structures are, in a sense, a brutally honest appraisal of the American data-security landscape. Every category of data that commands a high price does so because exploiting it is both profitable and difficult to prevent. Every category that sells cheaply reflects either an abundance of supply, a robust defensive infrastructure, or both.

Law enforcement agencies including the FBI's Cyber Division and the Secret Service's Electronic Crimes Task Forces conduct ongoing operations to disrupt these markets, but the underlying demand persists. The most durable protection available to individuals is not waiting for enforcement action — it is understanding the value criminals assign to your personal information and hardening the most lucrative targets accordingly.

The underground economy has already done the risk analysis. It would be prudent to read its conclusions.