Is your payment card in a criminal’s digital wallet?
-
Discussions on adding stolen cards to mobile wallets nearly tripled over the year.
-
The median price of a stolen card is $10, but “wallet-ready” cards are much more expensive.
-
Combining card details with personal information can more than double the price.
About the research
Stolen payment cards are still the single most traded item on the dark web — but what are criminals really willing to pay for? Which cards are deemed worthless and sold in bulk, and which ones demand a premium?
To answer these questions, NordVPN and NordLayer Intelligence by NordStellar researchers looked into popular underground marketplaces and examined years of criminal discussions on hacker forums and Telegram channels. Our study exposes how the stolen card trade is changing and where it’s headed.
Shifting card fraud trends
The latest dark web marketplace analysis by NordVPN and NordLayer Intelligence by NordStellar researchers revealed that criminals are changing their habits. Discussions on dark web forums and Telegram that revolve around loading stolen cards into mobile wallets have nearly tripled when compared to last year.
These discussions aren’t just empty words. The listings of “wallet-ready” cards and associated services, like the theft of one-time security codes or the sale of phone “tap” relay tools, are on the rise. By contrast, older payment cards are losing most of their value due to being known by bank fraud systems, while classic magstripe cloning is very ineffective against most chip readers.
New focus: Using stolen cards in mobile wallets
Loading a card on Apple Pay or Google Pay wallet shifts some of the security burden from the bank’s own systems to the user’s phone. Criminals can exploit that in a few steps:
01
The criminal attempts to load a card bought off the dark web into their Apple Pay or Google Pay wallet.
02
The bank tries to verify the cardholder’s identity, typically by issuing a one-time code.
03
The criminal compromises the verification process — for example, by using malware installed earlier or employing phishing tricks.
04
Once the card has been loaded, the criminal moves fast to maximize its value through contactless shopping, gift card purchases, or cash withdrawals.
According to criminal discussions, 60-70% of publicly available cards can be soft-declined or blocked within 15-90 minutes of their first use. But in the criminals’ own words, it is “[t]he easiest way to cash out in 2026. No 3DS to worry about… Once added to Google or Apple Pay, it’s good to spend full balance.”
What are hackers looking for?
Sifting through the data obtained from dark web marketplaces, it becomes clear that criminals are increasingly valuing convenience over raw numbers. The most expensive listings don’t necessarily have the most cards or the biggest bank account balances — instead, they advertise cards that “just work.”
Dark web sellers grade their stock by expected activation success rates, with terms such as “fish-grade” used for cards with a 30-60% chance of activation and “standard-grade” for cards with near-guaranteed activation. Ironically, they also seem to take customer satisfaction seriously — around 80% of the studied sellers offered some form of refund or replacement for dud cards.
These screenshots from the dark web have been partially obscured, and they are presented for educational purposes only.
What determines a card’s price?
Stolen cards appear to be subject to the same market forces as regular goods. The median price of cards on the monitored dark web marketplaces was $10.
Card validity
The median price of cards advertised as “very high quality” is $22, which is likely the result of criminals believing that they are the most likely to work. In general, “wallet-ready” cards go for 3-5% of the balance remaining in the associated account. By contrast, older cards (which have likely already been canceled) can be sold in bulk for around $2.
Region and availability
Card prices vary drastically by region. More than 70% of all card listings in the study came from the United States, creating strong competition between sellers and keeping typical prices relatively low (around $10 to $12). Listings of cards from other affluent regions were rarer and more expensive, while cards from Africa commanded particularly low prices.
Added personal details
Personal information is valuable — our researchers found that cards bundled with personal details cost more than those without.
For example, in the largest marketplace analyzed, one card bundled with the cardholder’s Social Security number and date of birth was listed for $18.15, compared to the median price of $11.70 for cards without this information. Another card with even more identity details was being sold for $23.
Zombie data: Giving dead cards a second life
Canceled (or “dead”) cards don’t necessarily disappear from criminal marketplaces. Even if they can’t be used for digital wallet fraud or online payments, dead cards may come with valuable personal information attached — information that can be used for phishing or various forms of identity-based fraud.
Our research found that “dead fullz” (unusable cards sold together with intact identity information) were being sold for around $1 per record. To put the value of personal information into perspective, we can compare “dead fullz” to the listings for older, presumably canceled cards, which are sold in bulk for around $2 per batch.
Methodology
This report presents the findings of two studies — an analysis of card listings from nine dark web marketplaces and a review of discussions on criminal forums and Telegram channels.
Work, browse, and shop more safely online with NordVPN
Keep your payment details and personal data out of the hands of hackers with NordVPN’s advanced security features.