The black-market price for stolen credit and debit card details has dropped to as little as $1.50, according to a newspaper investigation.