Credit card details sell for 25p on internet

Stolen credit card details are selling for as little as 25p on an illicit internet-based black market in fraudulently-obtained personal financial details, which has generated a rise in cybercrime.

Bank account details are said to retail at anywhere between £15 and £200 while social security and other identification details can be obtained for less than £5.

Symantec, a leading internet security firm, said in its latest review of threats on the internet that the development of the "underground" on-line economy had driven down the prices of stolen details.

Con Mallon, director of product marketing at Symantec, said: "What we've seen in the last six months is a marketplace developing where the volume of availability is pushing down prices. Criminals are having to compete to sell personal information."

Six months ago, it is said, credit card details, usually sold in blocks of ten or twenty, were available for £1 each. Now fraudsters can buy four for the same price. 

Credit card details account for almost a quarter of all personal information being bought and sold, Symantec has found. Bank account details are the next most common type of fraudulently-obtained information.

About 70,000 people fell victim to identity fraud in 2006, according to one estimate by Experian, the credit reference agency. 

Symantec believes the figure could be much higher as it is difficult to know how many people's details are being obtained, sold and used at any one time. 

Its report links the falling cost of stolen data to a surge in "phishing" e-mails, which mimic a recipient's bank or building society or companies such as eBay, to obtain individuals' account information and passwords.

Institutions regularly caution customers to ensure they are using legitimate, secure websites to conduct financial transactions and not to respond to suspicious e-mails.

Since April, Symantec says that it has recorded 2.3 billion phishing e-mails sent out to internet users worldwide, an increase of 53 per cent on the previous six months.

James Jones, of Experian, said: "The vast majority of identity fraud used to involve people's previous address details, due, for example, to new residents taking advantage of post to accept and apply for credit. 

"More recent trends are for fraud using present address details, which are harder to obtain, and involves the interception of people's mail."

Symantec's Internet Security Threat Report, covering the first half of the year, said the on-line trade in stolen details highlighted the commercialisation of internet crime, with gangs researching, developing and marketing software for other criminals.

William Beer, director of security practice for Europe, said the hackers are obtaining the information through increasingly targeted attacks on computers that often involve collecting personal information about a person from social networks such as MySpace or Facebook.

With specific personal details, the hacker can construct a personalised email that entices the victim to either click on an attachment containing malicious software or visit a phishing site.