FOR SALE: Your personal details
The personal details of more than 20,000 people in Scarborough and Filey are for sale to cyber hackers, an investigation shows.
Passwords and email addresses, from accounts such as Paypal, online shopping and Netflix, can be used to steal money and identity of people without them knowing.
“Dark web” marketplaces are even offering moneyback guarantees for bulk purchases of people’s account passwords, which can come coupled with one or a mix of email addresses, credit card
numbers, usernames and even personal details such as first cars and mothers’ maiden names.
An investigation has revealed that in Scarborough and Filey a total of 21,163 are almost certainly unaware that, at the very least, their email address and password is on sale with the hardest hit postcode being those in YO12, with 10,430 peoples’ details up for grabs. Up to 6,598 people in YO11 are affected, with 1.608 and 2,527 peoples details up-for-grabs in YO13 and YO14 respectively.
The study by our newspapers, alongside, London data firm C6 reveals the true extent of the booming identity trade among the criminal underworld for the first time.
The worrying numbers have been collated over a series of years by a team of cyber moles embedded in the murkiest reaches of the dark web, observing wholesale transactions through encrypted chat rooms.
Emma Mills, chief operating officer of C6, which runs the hasmyidentitybeenstolen.com website, said the rapidly growing number of people at risk of being defrauded needs to act as a wake up call.
She said: “As consumers we have never really paid the price for fraud we’re used to, the banks picking up the credit and debit card losses. We don’t see the downside to ourselves of being careless with our personal information.
“We don’t clearly understand the impact of having our identities compromised and how long and painful it is to re-build that genuinely, it causes problems with applying for credit or any other form of account.”
Often the online marketplaces sell only partial information about an individual that can be fledged out over a period of time.
One site visited by Johnston Press Investigations allowed users to bulk purchase Paypal accounts for one US dollar per account, with a minimum purchase of 100 at a time.
The store, which also purported to sell Ebay accounts, offered an 80 per cent working guarantee.
On its own, a person’s streaming service account details – a username and password - could be seen as innocuous. But profiles can then be ‘enriched’, often over a series of months, or even years.
If, like half of all internet users, a person uses the same password for multiple accounts those Netflix login details could be crucial to gaining access to a person’s email address – and with it a host of other accounts simply by pressing the ‘forgotten password’ button.
Once the identity is rich enough, fraudsters can open credit card accounts in a person’s name, buy goods and transfer money.
DS Steve Thomas, head of crime operations at North Yorkshire Police, which has a dedicated unit, said cyber crime was a big issue.
He said: “One of the key challenges is evidence. In terms of cyber crime, it isn’t quite as tangible. They could well be sat a thousands miles away in another country, but the impact on the victim is still substantial. Encryption is a powerful tool, but it can be challenging.
“The focus is in making sure it’s policed as any other community, and to raise the fear that you will be caught.
“There are some real positives – it’s not the case any more that we’re not able to do this. We’ve made huge progress. There are some really good examples recently of our being able to identift, track, and resolve cyber crime criminality.”
“Many victims of cyber crime are vulnerable. We’re able to tackle cyber fraud, sexploitation, we’re growing these teams. It’s a finite budget. I would always want more. We do the best we can with what we get.
“We have an affluent area, rural communities and an ageing population. They are often targeted by those for their financial clout. Our victims group is aged 60 to 69.”
• See page 24 for more on how to avoid becoming a victim of cyber crime.