The online marketplace where your bank details are on sale for £12

Just imagine an online world where you are totally anonymous. Every click, website visited and item ordered is hidden and can’t be traced back to you.

Welcome to the ‘Dark Web’ — a criminal’s paradise, where crooks can trade in drugs and weapons, stolen credit card details and counterfeit goods.

And because activity in this internet underground cannot be traced, they can operate undetected by the police.

Surfing the Dark Web: Reporter Amelia with independent cyber-security expert Chris Underhill

For years, experts have warned that fraudsters use the Dark Web to buy and sell our personal data, which they can then exploit to con victims out of their life savings.

So I’ve come to Devon to meet Chris Underhill, an independent cyber-security expert, to see for myself what is going on in this part of the internet.

It may surprise some but you don’t need a complicated computer system and endless encrypted passwords to access the Dark Web. We are sitting in Mr Underhill’s very civilised home office at his personal computer.

For obvious reasons, I won’t say exactly how we did it — but after just a few seconds we are in. At first glance, nothing seems terribly amiss.

We are taken to a homepage, which aside from being purple, looks like any other search engine with a space to type in what you are looking for.

The only clue we are somewhere suspect is the strapline: ‘Explore. Privately. You’re ready for the world’s most private browsing experience.’

The Dark Web was created in the 1990s by the U.S. Navy to keep defence plans private, Mr Underhill explains.

Believed to be 5 per cent of the total internet and around the same size as the surface web, the standard internet used to access sites such as Google and Amazon, it’s not all bad.

Going cheap: A Dark Web marketplace offering credit card and Paypal account details for prices starting at under $8 US

‘It was not built for evil purposes’, he says. ‘Legitimate organisations such as Facebook and the New York Times have versions of their sites for the Dark Web for users to avoid censorship and give a voice to those living in repressed regimes. But, like any city there are areas where criminals work.’

The problem is it’s all too easy for criminals to access the bad parts.

Mr Underhill shows me the World Market website — which he likens to the eBay of illegal shopping.

Categories are listed on the side and include 12,711 drugs listings, 3,787 for fraud and 647 for counterfeit goods.

When we click on fraud we browse sub-categories such as stolen credit card information (including names, card numbers and addresses) starting at £12 and online banking details. There are also listings called ‘dumps’ and ‘drops’.

‘Dumps’ is the fraudsters’ word for the raw information stolen from a bank card’s magnetic strip which is put onto a fake card, Mr Underhill says. ‘Drops’ is slang for physical addresses used to send illegal or stolen goods.

Users can also buy fake website templates for High Street banks for just £22. These are often used for ‘phishing scams’.

This is where customers receive an email or text claiming to be from their bank telling them to log into their account and update their details.

Scammer supplies: Sets of 100 mobile numbers for NatWest customers on sale for £33. The seller claims they were collected from banking logs and other sources of stolen information

But the link takes them to a copycat website, where crooks then steal their details and money.

One seller advertised several kits including one listed as ‘Santander UK 2021 Latest Scam Page’.

This turned out to be an almost identical template of Santander’s online banking page, plus some of its customers’ details, including bank and security information.

The same user also sold pages for Nationwide, HSBC, Halifax, Lloyds and Amazon for £36 each.

Sets of 100 mobile numbers for NatWest customers were on sale for $45 (£33). The seller claimed they were from banking logs and other sources of stolen information.

Fraudsters who buy these numbers can target customers posing as NatWest. The extra information about customers then helps the crooks appear more legitimate.

One scam sees victims tricked into thinking their account is under threat, and told to transfer their cash to a ‘safe account’.

The fraudster then runs off with the money as soon as it lands. These so-called ‘impersonation scams’ involving bogus police and bank staff accounted for 14 per cent of all bank transfer scams last year.

Around £96.6 million was stolen — a fifth of all money lost to bank scams, according to trade body UK Finance.

Just over half was refunded by banks in line with a new code of conduct that promises fairer treatment of victims — but thousands were not so lucky. 

Money Mail has exposed how some banks are failing fraud victims by not reimbursing them, with the worst offenders fully refunding customers in just 1 per cent and 3 per cent of cases.

PayPal accounts with balances between £725 and £1,088 were on sale for £5, with one seller offering a ‘buy two get two free’ deal.

Counterfeit documents: A Dark Web site selling fake UK passports for £1,000 and UK bank accounts for £700 – which could be used to siphon stolen funds

Crooks could also snap up Equifax credit reports with a score of more than 800 at a cost of £22. These can aid fraudsters in identity theft, which involves taking out loans and credit cards in victims’ names.

Mr Underhill says: ‘The people selling stolen details on sites like these are unlikely to be big scale hackers. 

‘Those criminals would be trading privately as quickly as possible. The ones we see here are more likely to be a disgruntled worker from a bank or small credit reference agency.’

There were also websites claiming to sell access to computers belonging to firms and individuals.

If someone could log into your laptop or tablet, they could install software which tracks everything you type, including account passwords and online banking details. Or they could lock the system, demanding a ransom.

The services of ‘Black Hat hackers’, offering to access online accounts with malicious intent, were also available.

Another site called ‘Stock Insiders’ welcomed users to the ‘dark side of Wall Street’ and offered up to £18,029 for tips about secret company acquisitions to take advantage of low stock prices.

Others sold counterfeit cash, fake passports for £1,000 and UK bank accounts for £700 — which could siphon stolen funds.

Most crooks advertising on the Dark Web request payments in cryptocurrency such as Bitcoin as this makes it harder to be tracked, with prices listed in U.S. dollars.

After a few hours, my head is spinning. It seems unfathomable that this information is so easily available.

The only thing that seemed to slow crooks was the internet speed. I’m told these sites run 50 per cent slower than typical websites because of the encryption needed to hide the user’s location.

Government agencies are working to clampdown on criminal activity on the Dark Web but this is difficult as users are anonymous and hard to trace. 

‘It is like whack-a-mole. Once you take down one site another just pops up,’ adds Mr Underhill.

Banks are believed to have teams of experts who trawl the Dark Web looking for suspect activity. 

HSBC and Nationwide say they work with specialist third parties to prevent fraud, while NatWest has a range of security measures to protect customers.

Santander adds that it uses a variety of tools to monitor the Dark Web for anything criminals might use to target customers.

Lloyds says it proactively identifies and removes information being sold on the Dark Web.

And PayPal says its dedicated security teams closely monitor and take steps to stop malicious activity from occurring. 

But for all their security measures, tougher action is clearly needed. Fraudsters cannot be allowed to trade our data with such impunity.

[email protected]

This post first appeared on Dailymail.co.uk