What is the dark web, and how does it work?

If you hear about your personal information showing up on the dark web, you may have plenty of questions.

But like many things in life, knowledge is power, and a solid understanding of the dark web—and what to do if your information is compromised—can help you take steps to protect your identity and accounts.

Key takeaways

• The dark web is a part of the internet that can’t be accessed from standard browsers.
• Using the dark web is legal, but it’s been used for illegal dealings, like buying stolen personal information, including Social Security numbers (SSNs), bank account information and passwords.
• There are ways to prevent your information from ending up on the dark web, like creating unique passwords and using monitoring services. 
• If you use CreditWise from Capital One, it will scan the dark web for your personal information and send you an alert if it detects anything.

The World Wide Web is made up of three main layers: the surface web, the deep web and the dark web. When you search the web, read news from a webpage or shop for sneakers online, you’re most likely on the surface web. Many people are familiar with this part of the internet.

If you sign in to your email account, you head into the deep web. This part of the web stores information protected by passwords. Your email, bank account and online health records are all on the deep web. 

The dark web is part of the deep web. And unlike the other layers of the web, the dark web can’t be seen from normal web browsers. Users can only access the dark web using special tools or software. Dark web users are anonymous, and their activity and IP addresses aren’t tracked.

Websites on the dark web end in “.onion” rather than in endings like “.com” or “.gov.” Users need special dark web browsers to access these sites. One example is The Onion Router, or “Tor” for short. And just as an onion has many layers, Tor has many levels of encryption. This is what helps keep users anonymous.

While its name may sound threatening, the dark web is used by some legitimate businesses and organizations. In fact, U.S. military researchers created dark web technology to send and receive messages anonymously.

Some journalists use the dark web to protect the identity of sources or whistleblowers. News organizations also use it to make journalism accessible in places where it’s blocked.

Still, because users are anonymous, the dark web is also used as an online black market by criminals for illegal activities like selling stolen information.

Some of the most common personal data bought and sold on the dark web includes: 

• Credit card, debit card and bank account information
• Personally identifiable information, like your name, date of birth, SSN or driver’s license number
• Passwords to social media accounts and subscription services
• Medical records
• Phone numbers
• Fake diplomas

If your personal information is spotted on the dark web, it could mean someone took the information without your permission.

Criminals steal personal information in a variety of ways. Some try hacking into accounts or using malware to capture passwords. Others attempt to collect information through phishing scams and SIM swaps.

But not all scams are high tech. Some thieves will even go through the trash to look for documents containing personal data.

A monitoring tool can help you stay on top of your personal information. CreditWise is a free service that gives you the ability to detect suspicious activity.

CreditWise scans the dark web—including thousands of unsafe sites, hacking forums and illegal digital marketplaces—and alerts you if it finds your SSN or email address so you can take action.

In addition to alerting you about your information appearing on the dark web, CreditWise also monitors your Experian^® and TransUnion^® credit reports for any meaningful changes. That way, you’ll know about recent credit inquiries, delinquent accounts and more.

If your email address or SSN is found on the dark web, it doesn’t necessarily mean it’s been used by a fraudster to commit identity theft. But it’s still important to be vigilant and take steps to help protect yourself. 

If you are a CreditWise user and get an alert, you’ll get tips about things you can do to help protect your personal info.

Worried your personal information might have been stolen? If it’s related to your email, the fix may be as simple as changing your password. If your SSN is involved, here are 4 steps to consider taking:

• Freeze your credit for free. This will ensure that no one can access your credit reports, which makes it more difficult for a thief to use your name to open a new line of credit.  
• Place a fraud alert on your credit report. Just call the toll-free fraud number of any one of the three nationwide credit bureaus: Equifax^®, Experian or TransUnion. This allows creditors to get a copy of your report as long as they take steps to verify your identity before opening an account in your name.
• Contact your financial institutions. If you discover your credit card, debit card or bank account information has been shared on the dark web, it may be a good idea to contact your bank or credit card company. It might offer recommendations and what steps to take.
• Keep tabs on your credit reports for suspicious activity. Learn how you can get free copies of your credit reports at AnnualCreditReport.com. You can also use CreditWise to see your TransUnion credit report.

Wondering how to protect yourself from identity theft? The Federal Trade Commission provides resources for dealing with lost or exposed information. There are additional steps you can take to help prevent hackers from accessing your information and sharing it online:

Choosing a strong password for every online account can help protect your personal information. Even if a cybercriminal steals one of your passwords in a data breach, they will only be able to access one account. If you receive an alert that your information has been compromised, it’s worth changing your sign-in information as quickly as possible.

Password managers are apps or browser plug-ins that encrypt—or scramble—and store all your passwords. Some may also create unique passwords automatically, which you can use when creating a new account. This can make it easier to keep track of your passwords—and make it more difficult for hackers to access your information.

Dark web monitoring services, like those available from CreditWise, scan the dark web for your personal information and notify you if they find your data online. That way, you can take protective measures like freezing your credit reports or contacting your financial institutions. You can also update breached account passwords to prevent any further leaks.

The dark web is a hidden layer of the deep web, where users are anonymous and activity isn’t tracked. There are legitimate reasons to use the dark web, like protecting whistleblowers or sharing confidential information. But some users exploit the dark web and use it for illegal activities, such as buying or selling stolen personal information. 

Luckily, learning about the dark web and how it works can help you take steps to protect your identity. Dark web monitoring services can alert you if your information is found online, too. And this guide's 7 ways to protect your identity online and offline can provide additional tips to safeguard your personal information.