Online hackers are selling stolen passport credentials

Hackers steal passport and ID card data to use it for illegal activities, such as crossing borders and taking bank loans in another person’s name. Cybercriminals only need to get the victim’s full name, birthday, nationality, and passport number to falsify their documents. While most people are aware of the common credit card frauds, not all of them know that stolen passport credentials can put them at more risk.

Identity theft is becoming a popular crime. In 2018, the Identity Theft Resource Center saw a 126 per cent increase in the number of data breaches, most of which affected sensitive personal information.

During a massive data breach at Marriot hotels in 2018, hackers accessed its reservation database, reportedly collecting information on 500 million people. The fraudsters stole guests’ names, surnames, contact information, and dates of birth. On top of that, they got the passport credentials of Marriot clients.

“When cybercriminal attack hotels, they gain access to people’s passports. That leads to a significant risk of the hotel clients getting their identities stolen. Moreover, passports and ID cards contain information that can be useful for social engineering. Fake IDs are later used to enter or leave the country, open bank accounts, or hide from the authorities,” explains Daniel Markuson, the digital privacy expert at NordVPN.

After stealing passport credentials, online hackers sell them in the black market. They use the data to create physical passports, their digital scans, and templates for finished IDs. The prices of passports in the black market may vary. A physical passport costs an average of $14,000 on the dark web. It may include the passport data, a digital chip, and other components, making it useable in many countries. Proof of identification (for example, a person holding a passport and a scanned copy of it) costs about $61 on the black market. Digital scans cost around $15.

There are ways to find out whether your passport data is being exploited by criminals. According to the Department of Homeland Security, people who come and leave the United States can track their international travel history. The system requires to enter their name, surname, birthday, and a passport number.

However, the function is not available in other countries. Fraudsters may be using people’s private data without the victims being aware of that. Thus, it is important to take some preventative actions to ensure that your identity information stays secure.

“First of all, it is worth paying attention to where you enter your passport data. Only enter your identity information on safe websites. Also, if you know that your sensitive information has been leaked during a data breach, it might be good to invest in checking it online. Finally, changing your passport after a possible data breach can also be an option,” advises Daniel Markuson, the digital privacy expert at NordVPN.