#IDTheftFTC

Tracking the Use of Leaked 

Consumer Data

Tina Yeung & Dan Salsburg

OTech | FTC Office of Technology Research & Investigation

www.ftc.gov/OTech | research@ftc.gov
#IDTheftFTC

What Happens to Leaked Credentials?

Research question:

When consumer credentials are made public, 

does anyone use them?

Goal:

Design and conduct a study that tracks the attempted use 

of stolen consumer credentials
#IDTheftFTC

Study of Credential Use

1. Create ~100 consumer accounts

2. Post account data publicly

3. Track use of data
#IDTheftFTC

Fake Customer Data

1. Name

2. Address

3. Phone number

4. Email address

5. Password

6. Payment mechanism

• Credit card number

• Online payment account

• Bitcoin wallet
#IDTheftFTC

Posting of Fake Customer Data
#IDTheftFTC

Posting One vs. Posting Two

• Same data, posted twice

• Different format and time of day

Posting 1: ~100 views

Posting 2: ~550 views

(Picked up by Twitter bot)
#IDTheftFTC

Monitoring of Data Usage

• Monitored for about three weeks

– Week before Posting 1 (Pre-study control)

– Week after Posting 1 (Week 1)

– Week after Posting 2 (Week 2)

• Logged

– Email account access attempts

– Payment account access attempts

– Credit card attempted charges

– Texts and calls received by phone numbers
#IDTheftFTC

Time Before First Unauthorized Access Attempt

Posting 1 Posting 2

1.5 hours 9 minutes
#IDTheftFTC

Total Unauthorized Access Attempts

1

119

1108

0

200

400

600

800

1000

1200

Pre-Study Week 1 Week 2

Number of Attempts
#IDTheftFTC

Unauthorized Access Attempts by Account Type

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Email Services Credit Card Numbers Payment Accounts
#IDTheftFTC

Account Activity
#IDTheftFTC

Email Account Access Attempts by Week

1

47

466

0

50

100

150

200

250

300

350

400

450

500

Pre-Study Week 1 Week 2

Number of Attempts
#IDTheftFTC

Email Access Attempts by Unique IP Addresses

0

5

10

15

20

25

30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 ... 44

Number of Unique IPs

Number of Attempts

(Likely underestimates access attempts)
#IDTheftFTC

Geolocation of IPs Used in Access Attempts

0

5

10

15

20

25

30

35

40

45

50

# of Unique IP Addresses

IP Country of Origin

IP Addresses

Suspicious IP Addresses*

*IP addresses identified as suspicious by a freely available service
#IDTheftFTC

Credit Card Purchase Attempts

• Max: $2,697.75, at a clothing website

• Total amount within two weeks: $12,825.53

– Includes multiple payment attempts

– Includes preauthorization charges

• Noteworthy attempts:

– Online dating service

– Pizza place

– Hotels
#IDTheftFTC

Amount Attempted per Charge

137

119

43

32

52

19 20 17

1 1

0

20

40

60

80

100

120

140

160

Number of Charges

Identified preauthorizations

Charges
#IDTheftFTC

Charge by Category

164

79

59

39 36

23 12 9 8 7 3 1 1

0

20

40

60

80

100

120

140

160

180

Number of Charges
#IDTheftFTC

Additional Thoughts 

• If you post it, they will use it

• Paste sites should be monitored by email and 

payment service providers

• Two factor authentication provides some protection 

against stolen credentials

• Merchants should consider refusing seriatim 

purchase attempts
#IDTheftFTC

Future work

• Analysis of email spam, text spam, and

phone calls received by fake consumer

email accounts

• Posting of consumer data in other ways that 

might attract different types of thieves

Have relevant research?

www.ftc.gov/OTech | research@ftc.gov
#IDTheftFTC

Contributors

• Sheryl Roth

• Phoebe Rouge

• Joe Calandrino

• Aaron Alva

• Justin Brookman

• Phillip Miyo

• Nicole Davis

• Aaron Kaufman

• Amber Howe

• Biaunca Morris

• Jonathan Aid

• Anne Blackman