According to recent research from NordVPN, prices for stolen payment cards on dark-web marketplaces rose in most countries. While the global average still sits around $8, some markets jumped by as much as 444%. In Canada, the average price fell from C$11.06 in 2023 to C$8.20 in 2025 — a 26% decline.
Many assume cybercrime happens to someone else, yet stolen payment card details change hands on these markets every day. It’s rarely just a card number: listings often include names, addresses, emails, and other details that help criminals pass fraud checks and impersonate real customers.
From $1 to $23: the forces behind Dark Web card pricing
Compared with other countries, Americans are most affected by payment card scammers. More than 60% of payment cards belonged to U.S. users. Singapore is second at about 11%, and Spain is third at around 10%.
However, high prevalence doesn’t equal low price. Stolen U.S. cards sit near the middle of the dark-web range at $11.51. At the same time, the most expensive listings come from Japan at roughly $23. Cards from Kazakhstan, Guam, and Mozambique go for roughly $16. At the low end, cards from the Republic of the Congo, Barbados and Georgia can sell for around $1.
Across North America, Antigua and Barbuda stands out as the most expensive country at $14. Mexican payment cards cost around $9.26 on the dark web.
Why prices spiked: supply, demand, and stricter anti-fraud controls
Their analysis shows that over the past two years, prices for stolen data have risen significantly. The largest increase was in New Zealand (more than 444%), followed by Argentina (368%) and Poland (221%), while France saw a modest rise of just 18%.
Pricing on the dark web mostly follows simple supply-and-demand principles. Criminals pay more for cards issued in countries with low supply and strict anti-fraud controls, such as Japan. In markets with abundant data, like the U.S. or Spain, cards are cheaper and often sold in bundles, lowering the price per card.
Carding: How criminals turn stolen cards into cash
Millions of cards are listed on the dark web, but the money is made in what happens next — the cash-out, a process usually called carding. Stealing or buying card data is just the start; the real skill is validating, monetizing, and laundering that data into actual profit.
Carding runs like an industrial supply chain. Different actors play specific roles: “harvesters” source or steal data, “validators” run bots that check thousands of cards per hour, and “cash-outers” convert validated cards into gift codes, goods, crypto, or cold cash.
The company advises individuals to do the following:
- Monitor your statements regularly.
- Use strong passwords.
- Don’t save passwords and payment data in your browser.
- Enable multi-factor authentication. Monitor the dark web.