According to NordVPN research, stolen payment cards sell for about $10 each on the dark web. In the past year, posts about loading these cards into Apple Pay and Google Pay have tripled. Criminals are getting around digital wallet identity checks by using SIM swapping and social engineering. Cards that come with Social Security numbers and personal details can sell for over $23 and are easier for criminals to use in digital wallet fraud.
The Old Card Theft Problem, and Why It Mattered Less
For years, stolen card data was mainly used for ATM withdrawals with cloned magnetic stripes or for online purchases that didn’t need a physical card. Both methods had their limits.
Contactless payments in stores are the most valuable target for criminals, but they require the card to be accepted at checkout. This meant using a cloned card or getting into a digital wallet. Cloning physical cards became harder with chip-and-PIN technology. Digital wallets seemed safer because adding a card required a verification step, like an SMS code, a phone call to the bank, or a one-time passcode.
Now, criminals are focusing on getting past that verification step.
The Tripling of Digital Wallet Fraud Posts
NordVPN’s research found that dark web posts about registering stolen cards in digital wallets like Apple Pay and Google Pay have tripled in the past year.
This change is not by chance. It shows how the market is evolving. Criminals know that once a stolen card is loaded into a digital wallet, it’s much more useful than just having the card data. They can use it for contactless payments in stores, buy gift cards, or purchase goods to resell for cash. It’s almost like spending real money.
The main challenge for criminals is getting past the identity verification step to register the card. They now use two main methods to do this.
SIM swapping means tricking a mobile carrier into moving your phone number to a SIM card controlled by the attacker. Once they have your number, they get the SMS verification codes sent by digital wallets to confirm a new card. The phone rings on the criminal’s device, not yours. When the code arrives, they enter it, and your card is linked to their device.
Social engineering means calling the cardholder or the bank and pretending to be a bank employee. The criminal tries to convince the person to read out the verification code they just received. It may seem simple, but it works often enough that it’s a common tactic in underground forums.
When criminals have a stolen card, the owner’s phone number, and a way to bypass verification, they call it a “wallet-ready card.” This combination sells for more. As we’ve discussed before, the dark web market pays more for data that can be used right away, not data that needs extra steps.
The Price Table and What It Tells You
The prices NordVPN found show what matters most to fraudsters: how easily the data can be turned into spendable money.
A basic stolen card costs about $10. If it comes with a Social Security number and date of birth, the price goes up to a median of $18.85, about 60% more. If it includes three or more extra details like name, email, or phone number, the price is over $23.
An older card that’s probably already canceled or deactivated sells for about $2. A card that’s likely still active and can be used for payments costs about $22.
Even when a card is suspended, the personal data linked to it still has value. These “dead fullz” records, which include name, address, SSN, date of birth, and other details, sell for about $1 each even though the card itself can’t be used. This is because the identity information can be used for things like account takeovers and creating fake identities, as we explained in our article about $200 synthetic identity packages on the dark web.
NordVPN’s listings also included South Korean data. Visa cards from South Korea sold for $10, Mastercards for $12, and passport or driver’s license information for $35 each.
“The Market Is Moving Beyond Simply Holding Card Data”
Marijus Briedis, NordVPN’s CTO, explained the change clearly. He said the underground market “is moving beyond simply holding card data and focusing on whether it can be converted into real money.” Criminals “are actively targeting verification procedures, account access and the identity information linked to cards.”
This new focus on verification and identity is the biggest change. Magnetic stripe cloning, which used to be the main method of card fraud, is now discussed less in forums. The attention has shifted to the credentials needed to access digital wallets and the identity checks that protect them.
The economics make sense for criminals. At $10 per card, buying 1,000 cards costs $10,000. If just 5% can be loaded into digital wallets, that’s 50 cards used for contactless payment fraud. Each card can bring in $500 to $1,000 in gift cards and goods before being flagged, so the return on the $10,000 investment is high.
This pattern explains why the dark web intelligence market is growing by 21% each year in the enterprise security field. Organizations are realizing that tracking stolen card data early gives them time to act before fraud happens.
What You Should Actually Do
NordVPN’s recommendations are practical and specific, and they go beyond the generic “monitor your statements” advice.
Turn on card transaction alerts right now. Most banks and card issuers offer instant push notifications for every transaction. If a fraudulent charge hits, you’ll know in seconds, not at month-end.
Act immediately if you get a notification about a new device being added to your digital wallet. Apple Pay and Google Pay both send alerts when a card is added to a new device. If you receive one and you didn’t do it, call your card issuer immediately, not in an hour, right now. The window to prevent use of a fraudulently registered card can be very short.
Never read a verification code to anyone who calls you. Your bank, Apple, Google, and your card issuer will never call you and ask you to read them a code that just arrived on your phone. The code arriving on your phone IS the verification. Sharing it gives whoever called you control of that verification.
Contact your carrier about SIM swap protection. Most major carriers now offer a port freeze or SIM lock that requires in-person verification or a PIN before they can transfer your number. It costs nothing and significantly raises the bar for SIM swap attacks.
If your card has been compromised, deactivate the digital wallet token specifically. Canceling the card isn’t enough if it was already loaded into a wallet. Contact your card issuer and explicitly ask to remove the card from any digital wallets it may have been added to.
If you think your card data or personal information is already out there, check our guide on what to do when your data is on the dark web. It gives you a full response checklist in the right order.
Frequently Asked Questions
How much does a stolen credit card cost on the dark web?
About $10 on average, according to NordVPN’s 2026 research. US cards average $11.86. Cards bundled with SSNs and dates of birth command a median price of $18.85.
How are criminals using stolen cards in Apple Pay and Google Pay?
They load the stolen card data into a digital wallet, bypassing identity verification through SIM swapping or by impersonating bank staff to extract one-time codes from victims.
What is a “wallet-ready card”?
A stolen card that can be loaded directly into a digital wallet without additional steps. These command higher prices because they’re immediately usable for contactless payments and gift card purchases.
What is a “dead fullz”?
The personal data attached to a canceled or deactivated card: name, SSN, date of birth, address. Even after the card is useless, the identity data still trades for about $1 per record on dark web markets.
What should I do if someone registers my card on a device I don’t recognize?
Call your card issuer immediately. Ask them to remove the card from any digital wallets, cancel the card, and issue a new one. Report the incident to your bank’s fraud department.
