The Dark Web offers an anonymous platform for trading of your valuable personal information.
If you’ve ever transacted online or your personal information is stored on any connected service, you’re vulnerable to web-based identity theft. The fact is that there’s a whole online marketplace out there where your information can be traded for as little as R20, to fraudsters who can use it to open accounts in your name, secure credit and even file false tax returns to claim illegitimate refunds.
There are three levels to the internet, as we know it. The ‘Surface Web’ is where we browse and share via social media. This represents about 4% of the internet, is the part accessed by most users, and is indexed by search engines like Google. The ‘Deep Web’ is the next level, representing around 93% of online activity and home to sites that aren’t indexed by search engines – things like internal company sites, school intranets, online databases and pages behind logins and paywalls.
The level beneath that is the ‘Dark Web’, the bottom 3% or so of the internet, known as such because its content is intentionally hidden from search engines and is only accessible via special browsers which mask the user’s identity.
While much of the activity on the Dark Web is legal, the anonymity it offers makes it a natural trading post for criminals. It is here that vendors can buy and sell stolen information. It’s a well-organised economy with platforms much like you’d expect to find on the surface web – buyers and sellers transact through payment platforms, with review functionality and dispute mechanisms such as those you’d find on your favourite ecommerce site. Except that the focus here is on obtaining as much valid information as possible, as quickly as possible – and making as much money as they can in as short a time as they can manage.
The easiest information to exploit is personal data – many people ignore warnings to keep their personal details secure online, and it’s a cinch for a savvy online operator to harvest information and either exploit it for their own gain, or sell it on to others who will do the same. ID numbers are generally available for purchase on the Dark Web for as little as R20. Accommodation rental website/apps account details are available online for about R120 and ride sharing apps for around R110. There are even ‘package deals’ offering full identity kits, known as ‘Fullz’, which contain name, date of birth, address, ID number, financial details and some other personal data, for between R75 and R370 – enough to access most online services and easily commit identity theft.
The most in-demand information is your ID number – the most common verification method used by online services. Think of the number of times you’ve been asked to enter your ID number as a validation mechanism for a new online service or to authenticate a password reset request – anyone with access to your ID number and email address could easily reset your password and start the process of identity theft.
The bottom line is that since many people ignore advice to use different passwords across the variety of sites they log into these days, it’s simple for an online fraudster to access multiple accounts and transact fraudulently.
While using unique passwords for different accounts and setting up two-factor authentication (where a code is sent to your phone to help authenticate your online logins) can help protect your online security, it’s hard to protect yourself from mass data breaches or being in the wrong place at the wrong time when being targeted by cybercriminals.
Be aware of emails regarding unsolicited banking transactions, ‘too-good-to-be-true’ offers and those bearing attachments from accounts you don’t usually interact with. These ‘phishing’ scams are one of the most common ways of sourcing your personal information, which is then sold on to cybercriminals.
Part of TransUnion’s active identity protection solution, TrueIdentity, is a service called ‘ID Monitor’. Part of a suite of identity theft protection tools, ‘ID Monitor’ scans the different levels of the online world – including the Dark Web - for signs that your identity information may have been compromised.
Scanning is done daily, with searches for your personal details, including your name, addresses, contact numbers, email addresses and medical aid details. If a breach is found, you receive alerts via email or SMS.
Vigilance is key – you wouldn’t hand your ID book or home address over to a complete stranger, so beware who you share your information with online or on the phone – or your ‘Fullz’ could soon be doing the rounds on the Dark Web.