Inside the Dark Web: Is Your Financial Data at Risk?
Fraud in the Digital Age: A Growing Threat
Year on year, the threat of financial scams increases as criminals find alternative ways to target individuals. Financial scams are taking on many different forms, from text message scams to social media to selling platforms online. Practicing safety online has never been more important. Fraud is now the most common crime in the UK, accounting for 40% of all recorded offenses in England and Wales in the past year, meanwhile, £11.4 billion was lost to fraud in 2024.
According to the State of Scams report, 1 in 7 Brits were targeted by fraud in the last 12 months, with 61% of Brits encountering scams at least once a month. The majority of scams are delivered via emails or texts, with Gmail, Whatsapp and Facebook seeing the biggest volume of crime occurring. Individuals were also targeted on apps, particularly dating apps, with 10% of scams happening here.
Scammers are increasingly leveraging AI to create sophisticated and deceptive scams, posing a significant threat to our identities and finances.
With deepfake technology, AI can be used to generate realistic human voices for compelling phishing calls and voicemails. This technology convincingly mimics real voices, making it difficult to distinguish between a legitimate call and a scam attempt. 44% of Brits are unsure if AI was used to scam them, which is a testament to how far this technology has progressed.
The Dark Web – A Hidden Marketplace for Stolen Data
Understanding the Dark Web
The dark web is a network of hidden websites and services that are encrypted and inaccessible through traditional web browsers. It’s accessed using specialised software and can be used for both legitimate and illicit purposes.
The dark web is often associated with illegal activities like the sale of stolen data, malware distribution, and the coordination of cyber-attacks.
The highest volume of dark web users is in Germany, where 2% of its population accesses the platforms daily. Finland and the Netherlands closely follow with 101,034 and 65,024 daily users, respectively.
How Financial Information Ends Up on the Dark Web
Financial information can end up on the Dark Web through various methods that are often linked to cybercriminal activities. Activity such as data breaches, phishing attacks and credential stuffing can expose information to the criminals who will then share the information across dark web marketplaces.
Phishing attacks are a social engineering technique where attackers deceive individuals into providing sensitive information, such as usernames, passwords, or credit card details, by posing as trusted entities. These attacks typically occur through emails, messages or fake websites. 14% of victims of cyber attacks said the scammer had made initial contact through email, while 10% had made contact through social media.
An example of a phishing attack can look like an email claiming to be from the victim’s bank, asking them to “verify” their account by clicking a link. This link redirects to a fake site that harvests their credentials. Phishing is highly effective because it exploits human trust and urgency, often bypassing robust technical safeguards. The stolen data is frequently used for financial fraud or sold on the dark web.
Credential stuffing is a type of cyberattack where hackers use stolen usernames and passwords, typically obtained from previous data breaches, to attempt to log in to other accounts. Since many individuals reuse the same credentials across multiple platforms, attackers can exploit this by using automated tools to test the stolen login information on banking sites, e-commerce platforms, or other sensitive services. For instance, if someone’s email and password from a breached retail site are also used for their online banking account, credential stuffing can grant the attacker access. This method is both efficient and scalable, allowing cybercriminals to compromise thousands of accounts in a short period. 62% of individuals had no initial contact with their scammers, which highlights how common an activity such as credential stuffing is.
Lastly, a data breach occurs when unauthorised individuals gain access to an organisation’s secure systems and steal sensitive information, including financial data like credit card numbers, bank account details, and personal identifying information. These breaches usually exploit vulnerabilities in the organisation’s cybersecurity infrastructure, such as outdated software, weak passwords, or misconfigured servers. Hackers might also gain access through insider threats, where employees with legitimate access leak or sell data intentionally. Once stolen, the data is often packaged and sold on the dark web to other criminals, enabling widespread identity theft and financial fraud.
The biggest data breaches affected the following companies, with more than 20 million records breached and users impacted.
| Company | Number of impacted users and breached records |
| Equifax | 15.2 million |
| Dixons Carphone | 14 million |
| Easyjet | 9 million |
| Virgin Media | 900,000 |
| JD Wetherspoon | 650,000 |
| British Airways | 429,000 |
| Wonga | 245,000 |
| Three Mobile UK | 133,827 |
| TalkTalk | 156,000 |
Source: Biggest Data Breaches in the UK [Updated 2025] | UpGuard
Equifax was caught up in one of the largest ever cyber security breaches, with 15.2 million customers impacted. Names, dates of birth, phone numbers, addresses and some credit card details of UK consumers were all accessed by the hackers in 2017.
Since the attack, they have reportedly invested $1.5 billion in a security and technology transformation.
Meanwhile, Dixons Carphone discovered its massive data breach in 2019 after the tills in its shops were compromised by a cyberattack that affected at least 14 million people. They found the attacker had installed malicious software on 5,390 tills in branches of its Currys PC World and Dixons Travel chains.
The rogue software went undetected for over nine months between July 2017 and April 2018 and collected a huge amount of data, leaving customers vulnerable to both financial theft and identity fraud.
Kristine Fossbakk, AI expert, business developer, and Data Services Director at Sharecat Data Services, comments:
“Not only are there more scams, they’re also getting smarter. There is more data online than ever before, and AI tools make it easier for hackers to get to it, change it, and use it for their own gain. Every time someone does something digital, they leave a trace. If businesses don’t care about security, these traces can become holes in their defenses.
The reason scams have surged is simple: accessibility. AI-driven automation allows attackers to scale operations, creating realistic phishing emails, deepfake scams, and identity fraud faster than ever. I’ve seen organizations struggle with AI-generated emails that perfectly mimic internal communications. Public data leaks also feed the cycle—once information is stolen, it circulates endlessly. A single breach can fuel scams for years.”
How is the information traded and sold anonymously online?
Information stolen through cybercriminal activities is often sold in specialised marketplaces or forums that cater to illicit transactions. These platforms are structured much like legitimate e-commerce sites, complete with user reviews, vendor ratings, and escrow services to build trust among buyers and sellers.
Financial information such as credit card details, bank account credentials, and full identity profiles (known as “fullz”) are listed for sale, with prices varying based on the quality and scope of the data. High-limit credit cards, verified PayPal accounts, or profiles that include addresses, and other personal data command higher prices. Some sellers specialise in raw data, while others offer pre-packaged “how-to” kits for committing fraud. Buyers often use cryptocurrency like Bitcoin to maintain anonymity.
The average price of illegal digital products on the dark web
| Account | Cost ($) | Type |
| Forged EU Passport | 3000 | Travel |
| N26 account | 2650 | Crypto Account |
| Wirex account | 2300 | Crypto Account |
| Nuri account | 2200 | Crypto Account |
| AirBnB verified account | 300 | Travel |
| Credit Card Details (Balance up to $5,000) | 110 | Banking Details |
| Card.com account | 75 | Banking Details |
| Credit Card Details (Balance up to $1,000) | 70 | Banking Details |
| Online Banking Login (Balance up to $2,000) | 60 | Banking Details |
| Gmail account | 60 | Social and Emails |
| Online Banking Login (Balance minimum $100) | 40 | Banking Details |
| Bet365 account | 35 | Gambling |
| Uber driver account | 30 | Travel |
| Facebook account | 25 | Social and Emails |
| Instagram account | 25 | Social and Emails |
| Twitter account | 20 | Social and Emails |
| 1,000 LinkedIn company page followers | 5 | Social and Emails |
| 1,000 Instagram Followers | 2 | Social and Emails |
Source: Dark web price of illegal digital products 2023 | Statista
The most expensive product on the dark web is reportedly a forged EU Passport, followed by Cryptocurrency accounts and Airbnb-verified accounts.
A forged EU passport provides access to visa-free travel across many countries, making it a valuable commodity for individuals seeking to evade law enforcement, engage in human trafficking, or start a new identity in another region. These passports can cost thousands of dollars due to the expertise required to make them appear authentic, including the integration of biometric features and security holograms.
Cryptocurrency accounts, particularly those with high balances or linked to stolen funds, are another expensive product. Cryptocurrency’s pseudonymous nature makes it attractive to criminals for laundering money or conducting untraceable transactions. Accounts with verified identities or wallets containing large amounts of Bitcoin, Ethereum, or other cryptocurrencies are highly prized. Criminals often use these accounts to bypass regulatory checks, further obfuscating their transactions and making them harder to track.
Verified Airbnb accounts also rank among the more expensive items sold on the dark web. These accounts often come with a positive review history and are used to facilitate fraudulent schemes, such as booking properties for illegal activities or using stolen payment methods to commit financial fraud. The accounts’ verified status and trustworthiness within Airbnb’s ecosystem make them valuable, as they allow criminals to blend in seamlessly with legitimate users.
The high prices for these products reflect both the skill and risk involved in creating or obtaining them, as well as their utility in enabling further criminal activity on a global scale.
Implications for Individuals
Exposure of personal financial data can have severe and far-reaching consequences ranging from immediate financial losses to long-term impacts on financial health, personal security and mental health.
Credit scores can be severely impacted by criminal activities from exposed financial data. This can be a result of fraudulently opened accounts that may go unpaid, leading to collection actions that negatively impact the victim’s credit history. Similarly, multiple unauthorised credit applications can harm credit scores and create a red flag for lenders.
A damaged credit report can then make it difficult to secure personal loans and mortgages whereby the victim may face higher interest rates.
In 2024, £11.4 billion was lost to fraud, and 15% of Brits lost money in a scam, while over two-thirds of fraud cases resulted in financial losses for individuals. Among these, bank and card fraud accounted for 78% of reported incidents involving monetary losses, with the highest percentage of victims (18%) losing a sum between £100 and £249. Similarly, cyber fraud saw high percentages of monetary losses, with the highest percentage of victims losing £50-99. While this sum may seem small, the implications of the crime are much bigger, particularly now that the criminal has access to personal data. Additionally, only 18% of scam victims recover their costs.
An additional hidden cost is the emotional cost the crimes have on their victims. Individuals can frequently experience feelings of shame, guilt, and self-blame, with two in five (40%) reporting that they were emotionally affected by cyber fraud. The violation of trust, whether from a phishing scheme, identity theft, or another type of fraud, can lead to heightened anxiety and fear, with 6 % reporting they suffered from panic attacks following the event. This can naturally limit individuals from feeling confident in completing financial transactions or sharing personal information in the future.
For some, the stress of dealing with the aftermath—such as disputing fraudulent charges, repairing credit, or recovering stolen funds—can result in sleepless nights and chronic worry. In severe cases, victims may develop symptoms of depression, feelings of isolation, or even post-traumatic stress disorder (PTSD), especially if the scam was particularly sophisticated or targeted deeply personal aspects of their lives. The emotional toll is compounded by the stigma surrounding scams, as victims may be reluctant to seek support, fearing judgment or ridicule.
Arne Helgesen, IT leader, technology manager, and cybersecurity expert at Sharecat Data Services, adds:
“If your data has been compromised, do more than just update passwords. First, create “junk” email accounts. If your main email is leaked, hackers will keep trying to reset passwords and send phishing attempts. Set up a new email for banking and critical accounts, then gradually move your logins over. It cuts down on spam and makes your accounts harder to target. Second, assume all security questions are compromised. If your mother’s maiden name or your pet’s name is part of a breach, it’s worthless as a security check. Instead, use a password manager to store fake answers—something completely random that only you know. Third, freeze your credit. Even if no financial data was leaked, identity theft often follows a breach. Freezing your credit stops fraudulent accounts before they start.
“To protect yourself online, use tools that actually prevent exposure. First, a good password manager like Bitwarden or 1Password ensures you never reuse passwords, which is the easiest way for hackers to gain access. Second, use a hardware security key like YubiKey for multi-factor authentication instead of SMS codes—SIM swapping is a real problem, and phone-based authentication is weak. Third, block tracking aggressively. Tools like uBlock Origin and privacy-focused browsers like Brave stop data collection at the source, reducing how much of your information is out there in the first place. Security isn’t just about fixing problems after they happen—it’s about making sure they don’t happen at all.”
Raising Awareness and Educating the Public
Shining a Light on Hidden Dangers
Public awareness campaigns play a vital role in equipping individuals with the knowledge to recognise and prevent cyber threats. Governments, cybersecurity firms, and non-profit organisations are increasingly focusing on educating the public about the dangers of dark web exposure and online fraud. Campaigns often emphasise common red flags, such as suspicious emails, fake investment opportunities, and deepfake scams, ensuring individuals—especially vulnerable demographics—can identify potential threats before falling victim.
Targeted campaigns have been instrumental in reaching young adults, who are often prime targets for cyber scams. Campaigns such as ‘Stop. Think. Connect.’ and ‘Cyber Aware’ focus on spreading key messages, including the risks of oversharing personal information on social media, recognising phishing attempts, and the dangers of engaging with unknown links or downloads. Many of these initiatives utilise social media influencers and interactive content to better engage digital-savvy audiences. By leveraging relatable messaging and real-life scam stories, these campaigns ensure that cybersecurity becomes a priority for young internet users rather than an afterthought.
With online scams becoming increasingly sophisticated, raising awareness about the hidden dangers of the dark web is more critical than ever. Through education and proactive cybersecurity measures, individuals can better safeguard their digital identities and minimize the risks associated with this underworld of cybercrime.
Recognising Red Flags – How to Spot a Scam
As online scams continue to evolve, users must be equipped with practical knowledge to identify and avoid potential threats.
Here, we have highlighted the common red flags to look out for that could result in you falling victim to a scam.
- Job offers: Be wary of too-good-to-be-true job offers or giveaways. Scammers often lure users with fake employment opportunities or free gadgets in exchange for personal information. Always verify sources before sharing personal data or clicking on links.
- Suspicious brand collaborations: Content creators and influencers can be more vulnerable to scammers, with a lot of their work happening online. Avoid suspicious brand collaborations that request upfront payments or login credentials. Scammers often impersonate legitimate brands to steal personal information or hack accounts.
- Unsolicited messages or friend requests: Be cautious of unsolicited messages or friend requests on social media platforms. Scammers may impersonate loved ones or financial institutions to extract money or sensitive details. When in doubt, verify through a direct call or official website.
- Check website URLs: Always check website URLs and read reviews before making purchases. Fake e-commerce sites can mimic real brands to steal payment information. Use secure payment methods and avoid deals that seem too good to be true.
By staying vigilant and adopting safe browsing habits, users can better protect themselves from the ever-growing threat of online scams. Awareness and proactive measures are key to maintaining cybersecurity in an increasingly digital world.
Steps to Take if Your Data Is Found Online
Discovering that your data has been exposed on the dark web or used in a scam can be alarming, but taking immediate action can help minimize the damage. Here are the crucial steps to follow:
- Change Your Passwords Immediately – If you suspect a data breach, update the passwords for all online accounts, especially banking, email, and social media accounts. Use strong, unique passwords and enable two-factor authentication where possible.
- Monitor Your Financial Accounts – Check your bank and credit card statements for unauthorised transactions. If you notice suspicious activity, report it to your financial institution immediately and consider freezing your credit to prevent further fraud.
- Enable Fraud Alerts – Contact your bank and credit bureaus to set up fraud alerts. This will notify you of any attempts to open new accounts in your name and provide an extra layer of security.
- Report the Breach – Notify the appropriate authorities, such as the Federal Trade Commission (FTC) in the U.S. or Action Fraud in the UK. These agencies can guide the next steps and help track down cybercriminals.
- Utilise Identity Theft Protection Services – Many organisations offer identity theft protection and monitoring services that alert you if your data is found in breaches. Services like Experian, LifeLock, and Norton Identity Advisor can help protect your identity from further misuse.
- Be Cautious of Follow-Up Scams – Cybercriminals may attempt to exploit victims further by pretending to offer solutions to the breach. Be wary of unsolicited emails or calls claiming to help recover stolen data.
Resources Available for Scam Victims
If you have fallen victim to a scam or had your data compromised, there are several resources available to assist you:
- Government and Law Enforcement Agencies: Many governments have dedicated fraud departments, such as the FTC in the U.S., the National Cyber Security Centre (NCSC) in the UK, and Europol’s Cybercrime Centre.
- Identity Theft Protection Services: Companies like LifeLock, Experian, and IdentityForce offer monitoring services to help detect suspicious activity and protect against further fraud.
- Scam Reporting Hotlines: Organisations such as Action Fraud (UK), the FBI’s Internet Crime Complaint Center (IC3) in the U.S., and the Australian Cyber Security Centre provide reporting hotlines and online portals for victims.
- Banking and Financial Support: Most major banks have fraud protection teams that can help secure your accounts, reimburse fraudulent transactions, and offer credit monitoring services.
By acting swiftly and leveraging available resources, individuals can reduce the impact of data breaches and safeguard their personal and financial security against future threats.