Connecting buyers and sellers
Data sellers post information about what type of data they have, how much of it, pricing, the best way for a prospective buyer to contact them and their preferred method of payment. Sellers accept online payments through various electronic mechanisms, including Web Money, Yandex and Bitcoin. Some sellers even accept real-world payments via Western Union and MoneyGram, but they often charge additional fees to cover the costs of using intermediaries to transfer and receive hard currency internationally.
Most negotiations for data take place via either online chat or an email account designated by the seller. Once buyer and seller agree on a deal, the buyer pays the seller up front and must then await delivery of product. It takes between a few hours to a few days for a seller to release the data sold.
Reviewing the transaction
If a buyer makes a deal but the seller never sends the data, or what arrives includes inactive or inaccurate information, the buyer will not sue for breach of contract or call the FBI to complain he got ripped off. The illegal nature of the transaction renders the buyer largely powerless to use traditional means of dispute resolution.
To rebalance this power, social forces come into play, maximizing rewards for both buyers and sellers and minimizing the risk of loss. As in systems from eBay to Lyft, buyers and sellers in many underground markets can publicly review each other's adherence to a negotiated deal. The parties operate anonymously, but have usernames that stay the same from transaction to transaction, building up their reputations in the marketplace over time. Posting reviews and feedback about purchase and sale experiences promotes trust and makes the marketplace more transparent. Feedback shows all users who operate according to community norms, whose behavior is worrisome, and which new users might not yet know all the rules.
This ability to post and review feedback presents an interesting avenue for market disruption. If all sellers within a market were to be flooded with negative and positive feedback, buyers would have trouble figuring out who is trustworthy. Some computer scientists have suggested that approach could disrupt the data market without the need for arrests and traditional law enforcement methods. More research into how to curtail the market for stolen data could investigate this and other potential strategies.