As global tourism recovers
Cybercriminals are profiting from a booming black market for stolen travel documents, with a new investigation revealing that personal information from millions of travellers across the globe is being sold on the dark web for as little as $10.
Joint research by cybersecurity firms NordVPN and Saily has uncovered a growing trade on dark web marketplaces in scanned passports, visa stickers, airline loyalty accounts and hotel reservations. The findings come at a time when global tourism is rebounding from the pandemic period, making travellers more vulnerable to digital exploitation.
The investigation, conducted in June 2025, analysed listings across underground forums and dark web sites. Researchers found that scanned global passports are widely available, with prices ranging between $10 and $200.
Verified passports from the European Union are among the most expensive, selling for over $5,000. Fake visa stickers, fraudulent bank statements, and hacked frequent flyer accounts containing millions of miles are also being traded, some for hundreds of dollars.
Data from the International Air Transport Association (IATA) shows that global passenger traffic has returned to near pre-pandemic levels, with a 36.1 per cent increase recorded in 2024.
The Middle East has played a significant role in this growth. Dubai International Airport remained the world’s busiest for international passengers in 2024, handling nearly 87 million travellers, while Doha and Riyadh saw double-digit growth.
As more people travel across borders, experts say cybercriminals are exploiting multiple methods to obtain personal information. Malware can be used to extract files from phones and laptops. Phishing attacks, often disguised as official airline or visa service platforms, trick users into uploading passport scans. In some cases, attackers take advantage of poor security settings on cloud storage to access sensitive documents.
Researchers also found instances where discarded boarding passes and lost documents at airports were recovered and sold online. With biometric and digital verification now commonplace, a scanned passport and selfie can sometimes be enough to bypass ID checks. Criminals are using deepfake technology to impersonate users and gain access to online accounts or services.
Middle Eastern travellers are not immune. In the Gulf, where digital adoption is high and frequent international travel is the norm, data exposure risks are rising. The UAE’s Telecommunications and Digital Government Regulatory Authority (TDRA) has previously warned residents against using public Wi-Fi networks without protection. However, the recent findings show that even more secure platforms can be compromised through breaches or social engineering.
The report also highlights the sale of Booking.com reservations at steep discounts on dark web marketplaces. Criminals are reselling these bookings, sometimes for over $250, enabling others to stay in hotels under someone else’s name.
Loyalty accounts, particularly those linked to airlines based in the Gulf and Europe, are also being targeted for resale, raising concerns about the exposure of high-net-worth individuals and business travellers.
According to the researchers, the black market appeal of travel documents lies in their utility. A stolen passport or hacked account can be used to commit identity fraud, book travel, open credit lines, or carry out phishing campaigns. The personal nature of the data makes it valuable and challenging to detect promptly.
Authorities across the Middle East region are being urged to increase awareness and encourage travellers to protect their documents. While encryption tools and VPN services offer some defence, the report stresses the importance of vigilance and caution when submitting personal information online. Users are advised to avoid uploading scans to unofficial websites and to monitor their financial and travel-related accounts regularly.
Image: Researchers found that scanned global passports are widely available, with prices ranging between $10 and $200. Credit: Ekaterina Belinskaya
