F6 Uncovers 16.5M Stolen Payment Cards Listed on Dark Web Carding Markets

Cybersecurity firm F6 has uncovered a massive underground market for stolen financial data, identifying over 16.5 million payment cards listed for sale between 2025 and mid-2026. For fintech professionals, this surge in illicit activity highlights the persistent vulnerability of legacy payment systems and the growing sophistication of global carding operations targeting Western economies.

What was announced

The report from F6 provides a granular look at the timeline and geography of card theft across the global illicit economy. In 2025, the firm identified more than 13 million cards listed for sale on underground marketplaces. The United States emerged as the primary source of these listings, accounting for over 8.6 million cards, which represents a significant majority of the total volume for that year. This high concentration in the U.S. highlights the country’s status as a top priority for cybercriminals operating in the underground market.

The geographical reach of these listings in 2025 extended to several other major economies, with the United Kingdom, Canada, France, and Australia rounding out the top five most affected nations. The data for the first half of 2026 shows a continuation of this trend, with an additional 3.5 million cards identified. A notable shift occurred during this period as Italy entered the top five most targeted countries, replacing one of the previous leaders in the rankings.

The economics of these underground card shops are also detailed in the findings. F6 observed that a single compromised card typically sells for a price point between $10 and $20. These shops function as organized marketplaces where stolen data is commoditized and sold to various actors for use in fraudulent transactions. The consistency in pricing suggests a stable and well-supplied market for stolen financial credentials, where the supply of data is high enough to keep entry costs low for fraudsters.

"Cybersecurity firm F6 has identified more than 16.5 million payment cards listed for sale on underground card shops during 2025 and the first half of 2026, with the United States leading the market."

F6

The companies involved

F6 is a cybersecurity firm that focuses on identifying and analyzing threats within the digital economy. As a player in the threat intelligence market, the company monitors underground card shops and illicit forums to track the sale of compromised financial data. The firm’s work involves the systematic identification of stolen payment cards, providing data points that are used to understand the scale of global cybercrime and the velocity at which stolen information is monetized.

In the broader fintech and security landscape, firms like F6 occupy a niche dedicated to post-breach analysis and the monitoring of the "dark web." Their research serves as a critical resource for financial institutions and payment processors who are the primary targets of the carding activities described in the report. By focusing on the volume, geography, and pricing of stolen assets, F6 provides a macro-level view of the risks facing the global payments infrastructure. While the company operates as an independent entity in the cybersecurity space, its findings are integral to the ongoing effort to secure consumer financial information against increasingly organized criminal enterprises. This monitoring is essential for identifying emerging patterns in how stolen data is packaged and sold to secondary fraudsters, allowing for a more proactive stance against financial crime.

What this means

The persistence of the carding market at this scale represents a significant challenge to the global push for secure digital payments. The fact that 16.5 million cards can be harvested and listed in such a short timeframe suggests that current fraud detection systems are still struggling to keep pace with automated harvesting techniques. For the fintech sector, this announcement puts the spotlight on the limitations of traditional card security. The industry is likely to see increased pressure to move toward biometric verification and hardware-based security keys to render stolen card data useless. As long as a compromised card maintains a $10-$20 market value, the incentive for large-scale data theft will remain, forcing a potential reckoning for issuers who rely on static card numbers. The shifting geographic focus toward Italy suggests no market is immune.