Excess of stolen identities leads to massive price cuts, US ID costs just $25
Cybercriminals have been busy over the past couple of years, and it's starting to show. Digital identity inventory levels have never been higher, and prices have never been lower. It's a great time to be a black market buyer.
Context & Ripple Effects
When Gawker itemized what a stolen credit card fetched on the digital black market back in January 2011, the trade read as boutique — discrete cards, per-item quotes, scarcity pricing. By November 2013 the supply side has inverted: cybercriminals are sitting on record-high inventories of complete stolen identities, and the clearing price for a full US identity has collapsed to $25.
The economics, not a single breach, are the story — and the security trade press treated it that way, with darkREADING picking the report up twice on the day. A glut this deep means upstream harvesting over the past couple of years has outrun what fraudsters can absorb.
First-order effects
- Buyers of stolen identities can now impersonate a US consumer for roughly the price of a takeout meal, making full-identity fraud — new account openings, not just card misuse — cheap enough to run at volume.
- Sellers holding excess inventory are forced to dump stock at commodity prices, compressing margins across the entire stolen-data resale chain.
Second-order effects
- Banks, card issuers and lenders absorb the difference: when a synthetic-looking customer costs $25 to fabricate, account-opening fraud scales faster than per-case review budgets, pushing verification costs onto financial institutions.
- Sustained low prices signal that demand is being met from ongoing breaches rather than old stock — keeping the harvesting pipeline (malware crews, breach resellers) commercially motivated.
Third-order effects
- If identity data behaves like any other oversupplied commodity, the industry's defense economics flip: protecting individual records becomes uneconomical, and the burden shifts to detecting fraudulent use downstream through behavioral and transactional signals rather than static personal-data checks.
- Persistent glut-level availability of US identities strengthens the case regulators and consumer advocates have been building for mandatory breach disclosure and identity-protection mandates — pressure that tends to follow visible consumer harm.
The trend: Stolen personal data is maturing into an oversupplied commodity market, where collapsing prices shift identity fraud from artisanal card theft toward industrial-scale impersonation.