A stolen payment card can be purchased on the dark web for around £9. A full digital identity pack - the kind of bundle that could allow a criminal to impersonate you across financial and government systems - costs roughly £30. These are not estimates drawn from a distant or abstract threat: they are median prices observed in active marketplace listings analysed by cybersecurity firm NordVPN, working in collaboration with threat exposure management platform NordStellar, across data gathered from January 2025 to February 2026.
The research, which examined more than 28,000 unique listings across 16 categories and multiple geographies, offers one of the clearest recent windows into the commodification of personal data - and the findings are a reminder of just how far the market for stolen identities has matured.
What Is Actually Being Sold
The range of items available is broader than many people assume. Payment card details represent only one category. Digital copies of passports - including scanned images - were listed at around £26. Driving licences appeared at a similar price point. Beyond official documents, hacked social media accounts and compromised streaming subscriptions such as Netflix were also among the items on sale.
What makes this market particularly efficient, from a criminal standpoint, is its structure. Dark web marketplaces have evolved over the past decade from loosely organised forums into relatively sophisticated platforms with product categories, seller ratings, and bulk pricing. The data traded is often aggregated from large-scale breaches, phishing operations, and credential-stuffing attacks - automated methods that test stolen username and password combinations across multiple platforms simultaneously. The result is a supply chain that keeps prices low and stock replenished.
The low cost of entry for buyers is significant. A fraudster does not need to compromise a system themselves. They can simply purchase what they need. That accessibility lowers the barrier to identity fraud considerably.
Why the Price Is So Low
The economics of stolen data follow basic supply and demand logic. Data breaches have become a near-constant feature of the digital landscape, and the cumulative volume of compromised records in circulation is enormous. When supply outpaces the ability of criminals to monetise individual records quickly, prices fall.
There is also a depreciation effect. A newly stolen card is worth more than one flagged and cancelled by the issuing bank. Similarly, login credentials lose value rapidly if the account holder has changed their password or enabled two-factor authentication. Sellers therefore price aggressively to move inventory before it expires. Buyers, aware of this dynamic, expect low prices and get them.
Marijus Briedis, chief technology officer at NordVPN, put it directly: "Every online account and identity document tied to you can carry a price tag on the dark web. What is so worrying is not just that this information is being sold, but how little it can cost for criminals to get hold of it."
The Broader Risk to Individuals
Identity fraud carries consequences that extend well beyond a compromised bank account. A stolen identity used to open credit lines, submit fraudulent benefit claims, or impersonate someone in a legal or medical context can take months or years to resolve. Victims often face the burden of proving they were not responsible for actions taken in their name - a process that is time-consuming, stressful, and sometimes costly.
The presence of document scans on the dark web adds a layer of concern that goes beyond financial fraud. A digital copy of a passport or driving licence can be used to bypass identity verification checks that are increasingly standard in financial services, rental agreements, and telecommunications contracts. These checks were designed to prevent fraud; when the fraudster holds what appears to be a genuine document image, the safeguard weakens.
To help the public understand their personal exposure, NordVPN has launched an interactive calculator designed to estimate how much an individual's accounts and documents might be worth to criminals on the dark web. The tool provides a breakdown by account type and document category. Briedis described the rationale: "The earlier people understand what their data is worth and how exposed they may be, the better chance they have of protecting themselves."
What People Can Do
Awareness is a meaningful starting point, but it has to translate into action. Several practical measures reduce the risk that personal data, if compromised, can be exploited effectively.
- Use unique, complex passwords for every account - a password manager makes this manageable
- Enable two-factor authentication wherever it is available, particularly on email, banking, and social media accounts
- Monitor bank and card statements regularly for unfamiliar transactions
- Be cautious about which services receive copies of identity documents, and check the privacy policies of platforms that request them
- Consider signing up for a dark web monitoring service that alerts you if your email address or credentials appear in known breach datasets
None of these steps guarantee immunity. But they raise the cost and complexity of exploitation for the criminal, which - given the abundance of easier targets available at low prices - is often enough to redirect attention elsewhere. The dark web market for stolen data is, at its core, a market of opportunity. Reducing that opportunity is the most realistic defence available to individuals right now.
