UK consumers are having their personal bank and credit card details sold online for as little as 20p, it has been claimed.

A report by web security firm Symantec reveals a growth in an underground economy of “cyber crime supermarkets” for buying and selling personal financial information.

Credit card information is said to be plentiful – although EU credit card details were found to be less available than US cards.

Bank account details accounts for a fifth of the market in stolen data.

Symantec also found regularly visited websites are being targeted by criminals as a means of getting people’s data.

The report states: “In the past, users had to visit intentionally malicious sites or click on malicious email attachments to become a victim of a security threat.

“Today, hackers are compromising legitimate websites and using them as a distribution medium to attack home and enterprise computers.”

Criminals take advantage of vulnerabilities to alter the websites’ codes so they can then get hold of users’ information.

Only four per cent of these vulnerabilities have been fixed by firms, leaving an “enormous window of opportunity for hackers looking to launch attacks”.

“Avoiding the dark alleys of the internet was sufficient advice in years past,” said Stephen Trilling, vice president at Symantec.

“Today’s criminal is focused on compromising legitimate websites to launch attacks on end-users, which underscores the importance of maintaining a strong security posture no matter where you go and what you do on the internet.”

Phishing – the practice of sending out false emails from banks or other firms in a bid to convince or panic people into giving key account data – is also still rising.

A 167 per cent rise in phishing websites was recorded in the last year.

In total, Symantec detected 711,912 new threats in 2007 compared to 125,243 in 2006.