A scan taken when you hand over your driver's license at a car rental counter can end up for sale on the dark web within hours.
KrebsOnSecurity reported Tuesday on a new ID theft marketplace called Nexus, which is offering more than 153 million driver's licenses for sale. The report's author found their own license in the database after renting an SUV, alongside licenses belonging to journalist Brian Krebs, his mother, an FBI assistant director, and several security researchers. Each entry reportedly includes front and back images of the ID, captured not just as a standard scan but also in infrared and ultraviolet. Nexus also advertises other forms of identification beyond driver's licenses, and according to the report, its inventory keeps growing.
The multi-spectrum captures are what make this more than a routine photo leak. Presumably, having infrared and ultraviolet versions of an ID may allow someone to produce a cloned counterfeit that can pass hologram tests, though the report doesn't confirm anyone has done so. That's a meaningfully bigger risk than a stolen photo, which usually isn't enough to fool a physical ID check.
This looks like the identity-theft equivalent of a supply-chain attack: one scan at a rental counter, hotel desk, or bar can compromise a document meant to prove who you are anywhere it gets checked.