Undercover researchers from the consumer group contacted 14 companies that sell data.
They managed to access personal information about half a million people over the age of 50, including details about their salary and pensions.
In some cases the data was on sale for as little as 4p an item.
Such information can be instrumental in helping scammers who con people out of their pension savings, or persuade them to move money from their bank accounts.
Ten of the firms failed to carry out proper checks to see if the researchers were from a registered company, according to Which?
And it said many of the companies appeared to be in breach of guidelines from the Information Commissioner's Office (ICO).
To share such data, companies have to show that the consumers concerned have given their full consent.
Such consent has to be "knowingly and freely given".
During its investigation, Which? found:
"Our investigation highlights that sensitive personal and financial data is being traded on a huge scale, with some companies apparently willing to sell to anyone who comes calling," said Harry Rose, Which? Money editor.
Which? advises consumers never to share their data with third parties.
The government has already announced plans to ban cold calling, even to individuals who have inadvertently opted-in to receiving marketing calls.
The new laws, announced in the Autumn budget, could see fines of up to Â£500,000 being levied on perpetrators.
Personal and financial data is being traded on a "huge scale" - and sometimes illegally - according to an investigation by Which?