Despite advancements in security document technology, here’s further evidence that the market for fake passports is alive and well. A recent report published by Comparitech points to the popularity of illegally sold “passport scans,” which offers cybercriminals a way to circumvent biometric chips, holograms, and other security features governments use to safeguard official documents of citizenship.
A passport scan is a digital picture of the ID page showing the bearer’s personal details and the passport’s unique nine-digit identifier. Fraudsters use them for opening bank accounts under a false identity. Passport scans are widely available online, selling for an average of $15, says Paul Bischoff who researches how personal data is sold. More daring sellers post a second form of ID like a utility bill or a selfie, which can raise the price to around $60. The more “add-ons,” or additional forms of identity offered, the higher the price. A French passport accompanied by a selfie and a utility bill is offered for $124.80, for example.
“The reason for this is because multiple forms of ID are usually required to pass proof-of-address and proof-of-identification checks on websites,” writes Bischoff. “These checks are often part of the account recovery process in which a user has somehow lost access to their account and must prove who they are to regain access.”
Digital scans are vastly cheaper and easier to acquire than physical passports. An authentic passport on the dark web is priced at $13,500 on the average, while a forged physical booklet sells for around $1,500.
“I was most surprised to learn how passport scans are used in scams,” Bischoff tells Quartz. “Many banking and financial institutions only require two pieces of identification to create an account which seems wildly insufficient in light of this research.” Bischoff explains that there’s a loophole in marketing schemes that makes them susceptible to bank drops—a dark web term that refers to using bank accounts with stolen or fraudulent credentials for money laundering. “Banks, payment companies, and cryptocurrency exchanges that offer signup rewards—a cash bonus, for example—don’t take additional steps to verify someone’s identity are prime targets for bank drop fraud.”
A US State Department spokesperson tells Quartz that they’re monitoring all types of passport and visa fraud. They didn’t offer details if they were particularly focused on passport scans. In the US, people caught committing passport fraud can face a 10-20 year prison term.