Virtual Credit Card and Bank Account Data on Sale with Instructions for Use on PayPal, eBay and AdWords

• A user on the dark web has put prepaid virtual credit cards (VCC) and virtual bank accounts (VBA) data on sale
• The dark web sale include full bank account number, CVV and expiry date
• The vendor offered instructions for making fraudulent transactions using the credit card details

A BreachForums user named Dantata has put Virtual Credit Card (VCC) and Virtual Bank Accounts (VBA) details purportedly of legitimate account holders for sale on the dark web.

The data could be used for fraudulent transactions on PayPal, eBay and AdWords, according to the post. The dark web vendor who appears to have joined the platform in April 2025 claims to have debit card details, complete with the 16 digits card number, CVV code, and expiry date.

Besides the bank card sale details, the notification posted on 16 April offered information about what a virtual credit card was and instructions for using the card for financial fraud. 

“Just enter the details in your PayPal account. Get the Expuse Number from me and BOOM!!,” read the dark web post. Like the dark web post read, such information could be used to make payment on e-commerce apps and websites, and web stores. 

The vendor asked potential customers to use real phone numbers for SMS code to approve the purchase of the said bank details. Anyone could buy the details by feigning their name, and address on Google Maps.

The virtual credit card expiration data ranged between 1 to 4 years. They would send the details within two days upon receiving payment for the same. It is not clear if the bank details belonged to U.S. customers or others however, the vendor asked for a randomized U.S.-based billing address.

It is essential for users to check the notification for all transactions they receive via SMS, emails, or other alerts. Missing a crucial update and checking their account transactions could lead to uninterrupted monetary transactions causing financial losses and/ or identity theft if the stolen details allow the creation of duplicated cards or documents.