Dark Web
The dark web is the portion of the internet reachable only through anonymizing networks such as Tor, where both visitors and servers can conceal their location. It is not synonymous with crime — the same anonymity serves journalists and people under surveillance — but it is where stolen identity data is bought and sold, which is the part that matters for identity verification.
| Access | Requires specific software; sites are not reachable through ordinary browsers |
| Distinct from the deep web | The deep web is anything not indexed by search engines — most of it mundane |
| How anonymity works | Traffic routed through multiple relays, each knowing only the previous and next hop |
| Legitimate uses | Circumventing censorship, protecting sources, private communication |
| Identity-relevant markets | Stolen credentials, full identity packages, document images, scans and templates |
| Pricing signal | Complete identity packages sell cheaply — supply vastly exceeds demand |
| What monitoring detects | Exposure after the fact, not the breach itself |
| Consequence for verification | Any static identifier should be assumed to be purchasable |
Dark web, deep web, surface web
| Layer | What it is | Scale |
|---|---|---|
| Surface web | Pages search engines index and anyone can reach | A small fraction of the whole |
| Deep web | Anything behind a login or paywall, or otherwise unindexed — email, banking, databases | The overwhelming majority |
| Dark web | Sites reachable only through anonymizing networks | A small fraction of the deep web |
The terms get used interchangeably and mean different things. Your online banking sits on the deep web. So does this sentence, if you are reading it behind a login. The deep web is enormous and almost entirely unremarkable; the dark web is small and deliberately hidden.
What is actually sold, and what that costs
The identity-relevant markets deal in a handful of categories.
Credential pairs — email and password combinations from breaches, sold in bulk and used for credential stuffing against other services.
Full identity packages, known as fullz — name, date of birth, address, Social Security or national identification number, and often answers to common security questions.
Document images — photographs and scans of passports and driver’s licenses, sometimes packaged with a matching selfie, priced specifically because verification flows ask for both.
Access and tooling — entry to compromised accounts, and the phishing and injection kits used to obtain more.
The price tells the story better than the inventory does. A complete identity package sells for very little, because supply is abundant and has been for years. The implication is not that data is cheap to buy — it is that any control whose security rests on an attacker not knowing a static fact about a person has already failed. That is the whole argument against knowledge-based authentication, stated in market prices.
Why this matters for identity verification
The correct design assumption is that every static identifier belonging to a given person is obtainable. Name, date of birth, address history, identification numbers, previous lenders, security answers — all of it. Verification that consists of asking for those facts, or matching them against a bureau file, is verifying that the person did their homework.
What is not for sale at any useful price is a live person who matches a specific document. Selling a stolen document image is trivial; producing the person it was issued to, in real time, in front of a camera, is not. That asymmetry is the reason document authentication paired with liveness detection holds up where data matching does not.
The asymmetry is narrowing rather than disappearing. Generative tools have made synthetic faces and manipulated document images cheap, which is why deepfake and injection detection now sits alongside the biometric check rather than being optional to it. Synthetic and stolen identity controls exist for exactly the population that these markets supply.
What dark web monitoring can’t do
It cannot remove anything. Once data is circulating it is copied indefinitely. A notification is information, not remediation.
It reports exposure after the fact. By the time data appears in a monitored market it has usually been traded privately for some time.
Coverage is partial. Monitoring sees the markets it can reach. Closed forums and private sales are not visible.
It does not tell you what was used. Knowing an identifier is exposed says nothing about whether anyone has acted on it.
Frequently asked questions
What is the difference between the deep web and the dark web?
The deep web is everything search engines do not index — email, online banking, databases, anything behind a login. It is the overwhelming majority of the internet and is almost entirely mundane. The dark web is a small subset reachable only through anonymizing software such as Tor.
What identity data is sold on the dark web?
Credential pairs from breaches, full identity packages known as fullz, images and scans of identity documents — sometimes bundled with a matching selfie — and access to compromised accounts. Complete identity packages sell cheaply, which is the clearest signal of how abundant the supply is.
Is dark web monitoring useful?
It is useful for knowing that exposure has occurred, and it cannot undo it. Data cannot be recalled once circulating, coverage is limited to markets the monitor can reach, and appearance in a market usually lags the breach by some time. Treat it as a prompt to change controls rather than as a remedy.
How should verification change if identity data is assumed compromised?
By not relying on knowledge of static facts. Anything an attacker can purchase — identification numbers, address history, security answers — verifies nothing. What remains difficult to obtain is a live person matching a specific authenticated document, which is why document verification with liveness detection holds where data matching does not.
Related reading
- Fullz — the packaged identity data these markets are built around
- Data breach — where the supply originates
- Credential stuffing — what breached credential pairs are used for
- Knowledge-based authentication — the control these markets destroyed
