Handing your driver's license to a car rental desk could put it on the dark web hours later

Handing your driver's license to a car rental agent might put a full scan of it up for sale online before you even return the keys.

An Ars Technica reporter found their driver's license listed on a dark web site named Nexus hours after renting a car. Security researcher Brian Krebs reported that the site added nearly 400,000 driver's licenses in a single 24-hour period. The leak appears tied to IDScan.net, a New Orleans service used by Hertz and 11 other companies. IDScan.net said it is investigating, and the FBI is on the case.

Why it matters: Most breaches leak plain text details like your name or address. This leak allegedly includes specialized ultraviolet and infrared scans, making the stolen cards far easier for fraudsters to reuse. Because the access appears to happen in near real-time, new IDs hit the market shortly after customers hand them over at the counter.

Know this: Nexus went dark shortly after the KrebsOnSecurity report, so there is currently no way to check if your ID was scraped.

Next time a desk agent scans your card, know that the image might travel much farther than the back office.