November 9, 2026, 10:47 a.m. (JST)
[Japan] NordVPN made an exclusive announcement to attendees and the media at the “Exchange Stage” of “Money20/20 USA 2026,” held from October 18 to 21, 2026.Gerald Kasulis, the company’s Head of Enterprise Channels, discussed credit card fraud involving wallets on the dark web.
Digital wallet fraud has
tripled in one year Stolen cards end up in criminals’ wallets
Although the details of NordVPN’s presentation were not disclosed in advance, the company presented research findings on the latest cybersecurity threats.NordVPN is the world’s largest encrypted communication (VPN) service, used by over 15 million users worldwide. By encrypting and securing internet connections, it protects personal information, passwords, and browsing history from hackers and third parties.
The company shares information on fraud schemes and leaked credentials—collected by its cybersecurity research team (Nord Threat Intelligence) from sources such as the dark web—with financial institutions and law enforcement agencies worldwide.
This announcement details the tactics and mechanisms criminals use to extract greater value from stolen card information and other data. It involves the mass generation and distribution of credentials on the dark web, as well as the resulting digital wallet scams—a trend that has tripled over the past year.
Bypassing security measures at banks and other institutions, intercepting and registering
accounts Contactless Payment fraud using stolen cards
NordVPN’s research team conducted a thorough analysis of 3,900 posts offering for sale or trading stolen data on major dark web forums (black markets) frequented by cybercriminals.The analysis revealed that approximately 24,000 sets of payment card and digital wallet linking data—issued by various banks and Payment Service Providers worldwide—were in circulation.
The report detailed how stolen credit card information—traded on the dark web—is being exploited in credit card fraud schemes. Criminals are bypassing standard financial institution security measures and registering stolen card information directly into digital wallets on smartphones. Furthermore, even when banks request additional identity verification (KYC), criminals are able to circumvent or intercept these measures to complete the registration.
Once registered in a digital wallet, the perpetrator can make purchases via Contactless Payment at Physical Store registers. As a result, even if the cardholder has the physical card in their possession and their PIN has not been stolen, they may not realize they’ve been victimized until they carefully review their account history.
The selling price of a card is around
$10. How do criminals determine a card’s value?
Furthermore, according to a 2026 survey by NordVPN, the proliferation of AI tools has made cybercrime more efficient, resulting in complete sets of personal information—including valid credit cards, email addresses, and identification documents (IDs)—being sold off cheaply on the dark web. The company stated, “Cards can sometimes be purchased for around $10 to $12.”Seventy percent of the listings are for U.S. cards, and fierce competition among vendors is driving prices down. The company stated that stolen cards are cheap not because the damage is minimal, but because the supply is endless. Furthermore, scarcity influences the price, and in countries with limited supply—such as Japan—a premium is added.
Furthermore, prices reportedly double depending on the information contained on the stolen cards. A card with an SSN and date of birth costs $18.85, while one containing three or more pieces of identifying information costs $23.The company states, “The more information—such as Social Security numbers, names, addresses, and dates of birth—is included alongside credit card details, the easier it becomes to combine different data breaches, amplifying the value of the data. Criminal organizations use the credit cards and sell the difference (the ‘spread’).”
The company also noted that only 3–5 percent of cards are sold at a price that allows them to be used directly in a digital wallet.Furthermore, the company noted that in today’s dark web markets, the value of stolen credit card information is determined not by “low price” but by “validity” (whether it can be reliably used). For example, according to the company’s data, cards proven to be of “very high quality (validity)” are trading at prices more than double the median—starting at $22.
Furthermore, canceled or blocked cards are being dumped and traded in large quantities on the dark web at rock-bottom prices—as low as just $1 per record. Criminals are using them for identity theft, SIM swapping, and opening fraudulent accounts.
NordVPN constantly monitors activity on the dark web. It also collaborates extensively with banks and financial infrastructure organizations worldwide, sharing insights on cyber threats while strongly building and expanding its international partnerships.For example, NordVPN features the Dark Web Monitor, which includes a transaction alert function that notifies users the moment suspicious activity is detected in linked U.S. bank accounts. Furthermore, the company’s research team is active on a weekly basis, sharing its findings.
