I've just received an email from "Co-operative Bank" informing me that a "message regarding 'payment on hold'" is waiting for me in my "Secure Message Center" and inviting me to log into my account to retrieve it. Even if I did bank with the Co-op, I'd like to think I wouldn't be foolish enough to fall for the scam. But in DarkMarket, Misha Glenny describes meeting Brazilian hackers who ran a phishing operation along these lines and "secured tens of millions of dollars for themselves from bank accounts in Brazil, Spain, Portugal, the United Kingdom and the United States". As Glenny observes, "if a hacker sends out several million spam emails, he does not need a high response rate in order for it to be worthwhile".

This morning's phishing bait dropped into my inbox from an anonymous address in Denmark; the hyperlinks to the supposed banking log-in page redirect to a site registered in Poland. A few years ago, the British anti-spam website spamhaus.org exposed a Polish hacker, Pavel Kaminski, who went by the nickname "Master Splyntr", as one of "the world's top five spammers". In 2006, Master Splyntr was made one of the administrators of DarkMarket, a website dedicated to facilitating the exchange of information  above all, stolen credit card details, extracted either through phishing scams or illegal "skimming" machines piggybacked on to cash dispensers  between hackers, "carders" (credit card fraudsters), spammers and other cyberthieves. Glenny's riveting and comprehensive account of DarkMarket's rise and fall shines a disconcerting light into some of the dingier corners of the internet.

Glenny conducted more than 200 hours of interviews to gather the material for DarkMarket, speaking to most of the major players on both sides of the law. The book is structured like a thriller, though the story's gripping enough not to need it. Glenny begins on the outer fringes of the DarkMarket web, where its tendrils reach out into daylight, with a West Yorkshire clergyman whose bank account has been hacked into. He then more or less follows the money, which leads him first to the Nigerian chemical engineer in Scunthorpe who was robbing Rev John, and on to DarkMarket's adminstrators: an unlikely alliance, possible only on the internet, of a Tamil crack addict in north London, a middle-class teenager in Baden-Württemberg, a representative of a Turkish crime syndicate, and Master Splyntr the Polish spammer. At least, that's who they appeared to be: one of them was in fact a deep cover FBI agent, who had infiltrated the site and who engineered its demise in 2008.

DarkMarket covers more physical territory than a Bourne movie. One of the reasons cybercrime is hard to police is that it's so widely distributed geographically. As Glenny puts it, money can be "stolen by a Russian in Ukraine from an American company and paid out in Dubai  and the whole transaction need last no longer than 10 minutes". Even if law enforcement agents are able to penetrate the sophisticated firewalls that the criminals hide behind, they often find prosecution difficult or impossible, either because of a lack of hard evidence  one hacker, Roman Vega, has been imprisoned without trial in the United States for seven years  or because their quarry is outside their jurisdiction.

A lot of the biggest carding operations have been run out of Russia and Ukraine, neither of which has an extradition treaty with the US. All Russian internet service providers are required to send a copy of every packet of data that passes through their servers to the secret police, and encrypting computer files is illegal. In theory, this means that all internet activity in the country is monitored by the FSB. In practice, this means that Russian gangsters could have a hard time ripping off their compatriots, but as long as they confine their activities to cardholders in the US and western Europe, the authorities are happy to turn a blind eye.

A bigger threat to cybercrooks may come not from law enforcement agencies but from other criminals. For a long time DarkMarket was subject to hacking attacks from Iceman, aka Max Ray Vision (né Butler), the mastermind behind a rival website called CardersMarket, until his arrest in September 2007. Last year he was sentenced to 13 years in prison. Vision used to be a patriot, seeking out and patching up holes in the Pentagon's cyber defences. The trouble was, he didn't see the need to tell the Defense Department what he was doing, and in 1998 he was arrested on suspicion of infecting them with a virus.

Glenny points out that the hundreds of billions of dollars being spent on cyber security are almost all "invested in technology", but "there is virtually no investment in trying to ascertain who is hacking and why". However, it's hard to go along with his suggestion, following a hazy summary of Simon Baron-Cohen's (much contested) work on autism and sex difference, that it could "be possible to identify hacker personality types among children who are still at school" and "offer them ethical guidance so that their abilities can be channelled in positive directions". One of DarkMarket's early chapters, ironically enough, is entitled "Miranda Speaks of a Brave New World".