Is your information on the dark web?

The dark web is a hidden area of the internet accessible only through a specialized browser. Dark web sites allow users to remain anonymous through encryption, which makes it an appealing place for criminals to carry out various of illegal activities. That includes the buying and selling of stolen personal information.

If you’ve ever been impacted in a data breach, it’s possible that your information could appear on the dark web. Criminals who buy consumer data on the dark web may use it to commit identity theft and fraud. A dark web scan can warn you if your data appears on the dark web, which arms you with the information you need to take the appropriate precautions.

Your sensitive data can wind up on the dark web in several ways, such as:

• Data breaches: Data breaches happen when criminals get past organizational security measures to gain access to sensitive information. For example, hackers may carry out cyberattacks that target large corporations to steal customer data. Then, the hackers may sell the stolen personal data on the dark web.

• Compromised documents: Lost or stolen mail and documents can lead to your sensitive information ending up on the dark web. For instance, criminals steal mail and then sell stolen bank checks or customer accounts.

• Malware: Cybercriminals may target victims using spyware to steal personal information, such as Social Security numbers, account passwords or bank account numbers. Then, they may list the stolen info for sale on underground marketplaces.

• Phishing: If you’re the victim of a phishing scam, the information exposed to the scammer could end up for sale on the dark web.

Protecting your sensitive information from winding up on the dark web requires ongoing vigilance and a knowledge of cybersecurity best practices. Here are some steps you can take to help protect yourself:

• Create strong passwords. Create unique and strong passwords for all of your accounts, especially those linked to sensitive information (such as your bank account). Using a password manager can help you keep track of your passwords. Enabling multifactor authentication (MFA) can help you add an additional layer of security and prevent access to your accounts in the event that your passwords are compromised.

• Keep your software up to date. You should be sure to install the latest updates for your computer and phone to defend yourself against hackers who take advantage of security flaws. Updates may contain essential security patches, so putting off updates may leave you vulnerable to cybersecurity attacks.

• Browse securely. Avoid logging into your accounts while connected to public Wi-Fi networks. If you need to use public Wi-Fi, consider using a virtual private network (VPN) to secure your web browsing session by encrypting the data you send and receive online.

• Know the signs of phishing. Phishing red flags can include urgent requests that you take immediate action, such as clicking on a link or responding with your Social Security number. Other signs can include suspicious email attachments, spelling errors, unusual grammar and offers that seem too good to be true, such as a free vacation. Staying aware of the latest scams can help you remain defensive.

• Don’t give away personal information. Criminals are constantly evolving their tactics in an attempt to trick you into revealing your data, so your first line of defense should be simply refusing to comply with anyone who contacts you out of the blue with a request that you provide them with sensitive data. For example, if someone claiming to be from your bank contacts you and asks you to verify your account number, hang up. Then, contact trusted institutions through a confirmed phone number or email address.

Even with these defensive measures in place, your information could be compromised due to forces outside of your control, including in a data breach. That means that, in addition to preventative measures, you should take steps to routinely monitor for signs of identity theft.

Cybercriminals use the dark web to sell information that can be used to commit acts of fraud, including:

• Names, addresses and phone numbers
• Social Security numbers
• Emails, usernames and passwords
• Medical records and account numbers
• Financial account numbers and details
• Driver’s license and passport information

Criminals can use your personally identifying information (PII) to carry out various types of identity theft and fraud. Some of the ways that fraudsters may use your sensitive data include:

• Selling your PII on the dark web: Hackers often list stolen dark for sale on underground marketplaces on the dark web.

• Taking over your accounts: Hackers may use stolen login credentials to take over your accounts, sometimes changing your password so that you can’t log back in.

• Applying for new accounts: Criminals may open new bank accounts or apply for new credit cards and loans using your name and Social Security number.

• Committing medical fraud: Scammers can use your sensitive information to commit medical identity theft, in which they receive medical services or prescriptions in your name. This can impact your own health benefits.

• Filing fraudulent tax returns: Criminals may commit tax fraud using your sensitive information, filing fraudulent returns and getting an income tax refund in your new.

• Stealing your government benefits: Hackers may use your data to apply for government benefits, such as unemployment, under your name.

Dark web scans work by crawling through hidden websites for instances of your personal information. An Experian Dark Web Scan looks back to 2006 and searches through over 600,000 pages for your Social Security number, email or phone number. If your information is exposed, you’ll get insights on next steps to take to keep your identity safe.

Since the dark web allows users anonymity, it’s an attractive way for cybercriminals to traffic stolen sensitive data. If your information is exposed in a data breach or a phishing attack, for example, the hacker may sell the stolen information to other criminals on the dark web. A dark web scan alerts you if your information shows up on these criminal sites, which can help you take steps to boost your security and avoid financial loss.

Routine dark web scans can be a prudent way to regularly monitor for exposure of your personal information. Beyond regular scanning as a security measure, there are some specific scenarios in which it can be prudent to run a dark web scan:

• You’re impacted in a data breach: If you’ve been impacted in a data breach, running a dark web scan can tell you if your sensitive data is being sold by cybercriminals online.

• You’re targeted in a scam: If you fall victim to a phishing scam, any exposed PII could end up circulated on the dark web. In addition to taking other measures to report the fraud and secure your credit and accounts, a dark web scan can help you understand the scope of the impact.

• You pick up on unusual activity: You might choose to run a dark web scam if you notice a pattern of suspicious activity, unauthorized inquiries on your credit report, fraudulent credit or debit transactions or an influx of spam calls or emails, for example.

• You’re preparing to apply for new credit: If you’re considering opening a new credit card, or if you plan to apply for a mortgage or auto loan soon, you could run a dark web scan as a way to see if your data has been compromised. Certain types of exposed information can put you at an elevated risk for new account fraud—i.e., when a scammer applies for new credit in your name. If you’re the victim of fraud, it can complicate getting approved for new credit cards and loans. Remember that you have the right to dispute information on your credit report that you believe is incorrect.

Here are steps to take if your information is found on the dark web:

• Change your passwords. Change any potentially compromised passwords right away to help prevent hackers from taking over your accounts. If you reuse passwords across multiple accounts, you should change those, too. Set unique, strong passwords for each of your accounts. You should also enable MFA for accounts that offer it, particularly those linked to sensitive data or payments.

• Monitor your accounts. Monitor your bank and credit card statements for any fraudulent transactions. You should also check your credit reports at all three national bureaus (Experian, TransUnion and Equifax) for signs of suspicious activity.

• Report signs of fraud. If you find that you’ve been the victim of identity theft, consider reporting it to the FTC, FBI and local law enforcement agencies, in addition to the impacted financial institutions.

• Place a fraud alert. You have the right to place a fraud alert or credit freeze on your credit reports. A fraud alert instructs creditors to take additional steps to verify your identity before processing applications for credit. A credit freeze can provide an added layer of security by preventing access to your credit report.

Yes, you can get a free one-time dark web scan from Experian to check if your Social Security number, email or phone number appears on the dark web.

There are also paid dark web scan options that can offer additional benefits. For instance, an Identity Theft Protection plan from Experian offers daily dark web surveillance, monitoring over 600,000 websites to detect if your sensitive data is exposed. The plan also includes a robust set of security features, including monthly personal privacy scans to remove your information from people finder sites and up to $1 million of identity theft insurance coverage.