Its inner workings were exposed in a recent report by security software vendor Panda Security (PDF). Posing as cyber criminals, Panda's people infiltrated the online marketplace and found that a large variety of illicit personal information, as well as goods and services, were for sale on Internet forums and at 50 online stores frequented by scammers from around the world.

Buyers buy the data to avoid the risk and trouble of having to steal it themselves.

Email lists for mass mailings of spam emails go for $15; stolen credit card numbers sell for as little as $2 each. Prices jump to $80 to $700 per account number if there are additional details or a "guarantee" of a high credit line. Records detailing past online transactions and PayPal payments fetch $1,500, reports Panda.

Much of this information is pilfered through some 63,000 "malware" threats that happen each day, says Panda, most of them carried out by organized crime rings.

The rings employ a variety of personnel:

• programmers who develop the information-stealing software that computer users unwittingly download. As the bin Laden scam proved, this software can be quickly prepared, thanks in part to what Panda calls pre-prepared kits for sale on line;

• distributors who trade in stolen data;

• "money mules" who complete wire transfers between the bank accounts of victims and scammers.

For commissions of 10 to 40 percent, some thieves provide money-laundering services.

Panda also found deals on various cards and hardware that scammers use. Cloned credit or debit cards start at $180. Machines that make duplicate plastic go for $200 to $1,000. And there are even fake ATMs, which capture the data and PINs of debit cards that unwitting people stick into them. The machines begin at $3,500 — with free delivery — but rise to $35,000 for the best models.

You may also like: ATM skimmers can read your pin numbers. >>

Sid Kirchheimer writes about consumer and health issues.