The FBI has opened an investigation into a sprawling identity theft operation offering millions of pilfered driver’s licences for sale online, according to cybersecurity journalist Brian Krebs, whose reporting first exposed the scheme.
The illicit marketplace, which caters to buyers across Canada and the United States, advertises high-resolution scans of licences alongside other personal documents. Krebs on Security, the blog run by veteran investigative reporter Brian Krebs, detailed how the service has been quietly amassing a trove of sensitive data for years, apparently without detection.
A Digital Bazaar for Stolen Identities
The operation functions as a one-stop shop for fraudsters seeking to assume someone else’s identity. Pitches posted to underground forums boast of “fullz” — industry slang for complete personal profiles — bundled with matching driver’s licence images. Prices vary depending on the quality of the documents and the depth of accompanying information, with premium packages including credit card numbers, addresses and dates of birth.
Krebs reported that the service’s operators have cultivated relationships with a network of data brokers, some operating within government agencies, who supply fresh scans on demand. The arrangement, if confirmed, suggests institutional failures stretching well beyond a single rogue actor.
How the Scheme Allegedly Works
Investigators familiar with the case, speaking on condition of anonymity, describe a multi-layered operation. At the ground level, individuals with access to motor vehicle records — including clerks at licensing offices in multiple states — allegedly feed scans into the pipeline. Middlemen then aggregate the documents before passing them to the online storefronts.
The FBI’s Cyber Division has reportedly coordinated with the Department of Homeland Security and the Royal Canadian Mounted Police to trace the infrastructure supporting the marketplace. Multiple domain seizures are anticipated, though officials cautioned that arrests could take months to materialise given the international dimensions of the case.
“It’s not just one guy in a basement,” Krebs told a podcast earlier this week. “This is infrastructure. This is logistics.”
The Scale of the Breach
While exact figures remain difficult to pin down, Krebs estimated that the service has trafficked in tens of millions of documents over its lifetime. Some listings reference databases containing licence images from every US state and Canadian province, raising the prospect that the breach touches nearly every adult driver in North America.
For victims, the implications are staggering. A stolen driver’s licence can unlock bank accounts, secure fraudulent loans, and enable everything from insurance scams to money laundering. Victims often learn of the compromise only when debts come due or warrants surface in jurisdictions they have never visited.
The breach also lays bare persistent vulnerabilities in how motor vehicle agencies safeguard sensitive records. Despite repeated warnings from privacy advocates, many state DMVs continue to rely on legacy systems with limited encryption and patchy audit trails.
Why it Matters
This investigation strikes at the heart of public trust in the institutions that issue identity documents. If licensing officials themselves participated in the trade, the fallout will extend far beyond criminal prosecutions — it will demand a reckoning with how governments protect the personal data of hundreds of millions of citizens. For now, the wisest course for any driver in North America is to monitor credit reports vigilantly and treat any unexpected correspondence from motor vehicle authorities as a potential warning sign.
