Dark web Dream Market drives cyber fraud industry

The Dream Market on the dark web provides cyber fraudsters with all the knowledge and tools they need, according to dark web security intelligence firm Terbium Labs.

Year-round, dark web suppliers sell detailed step-by-step cyber fraud guides and full identity packs, known as “fullz”, which contain full names, social security numbers, driver’s licence numbers, dates of birth and other personal information, but the market goes into overdrive as the US tax return season approaches.

Although fraudsters can use fullz to commit tax fraud, tax summaries issued by employers (W2 forms) and employee identification numbers are required.

According to Terbium Labs, W2 forms are available from Dream Marketplace sellers for $52 (£38) worth of bitcoin, while on other marketplaces, they go for $45 (£32) each or $35 (£25) each for orders of 10 or more.

However, fullz for children command higher prices because they enable fraudsters to file fraudulent tax claims of up to $1,000 per child, with infant fullz costing about $312 (£222).

Although Terbium Labs has seen child data for sale before, researchers said this was the first time they had seen infants’ data for sale.

“It is unusual to have information specifically marked as belonging to children or to infants on these markets,” the company’s director of analysis, Emily Wilson, told CNN.

Infant fullz also command a higher price because they give fraudsters access to clean credit histories. This enables criminals to apply for credit cards, government grants, mortgages and other loans, with the added bonus that these frauds often go undiscovered until the victims are old enough to open credit accounts.

“While these fullz don’t come complete with the parents’ information, they do come with the mother’s maiden name,” Terbium Labs analyst Emma Z said in a blog post. “An enterprising buyer can find the remaining details through open source datasets or by harvesting the parents’ other online presences, such as social media accounts.

“The recent disruption to the tax code and the shake-ups on the dark web will not stop the tax fraud machine. As always, fraud finds a way.”

According to the UK’s Fraud Prevention Service, Cifas, a record 89,000 identity fraud cases were reported in the first six months of 2017, up 5% on 2016.

Identify fraud accounted for more than half of all fraud recorded in the first half of 2017, with 83% of offences committed online. The Cifas data showed a sharp rise in identity fraudsters applying for loans, online retail, telecoms and insurance products.