spotlight on the dark web
The Dark Web Has Become a Shockingly Comprehensive Fraud Resource
For more than a decade, the dark web has sheltered fraudsters, presenting an array of fraud-as-a-service offerings with convenience. It’s given every data breach a long tail, and turned customers’ personally identifiable information into a commodity that can be sold and resold endlessly.
Though it’s estimated at less than a hundredth of a percent of the World Wide Web’s size (by total addresses), the dark web has an outsized hold on the popular imagination. Invisible to traditional web search, these sites can only be accessed through special software that carefully preserves users’ anonymity. The dark web has long been a safe haven for criminals to engage in a wide variety of secret, illicit activities. It’s become an incredibly rich resource for fraudsters and helps generate billions in illegal proceeds annually.
LexisNexis Risk Solutions, part of RELX, commissioned a study in 2025 to explore the dark web and better understand this phenomenon.
Meet Fraud-As-a-Service: An Anonymous, One-Stop-Shop Criminal Superstore
On today’s dark web, fraudsters can shop confidently and anonymously. They can buy
products, like lists of consumer credit card numbers, plug-and-play synthetic identities, mule accounts and private medical data. And they can tap into a rich pool of business insights like consulting forum threads before targeting particular institutions, or can read whitepapers on bypassing fraud controls. They can download self-help how-to tutorials or sign up for dedicated seven-day mentorship programs.
Many dark web sites require an administrator’s invitation. But once inside, fraudsters typically find an oddly familiar customer-centric world of product descriptions and shipping methods, ratings and reviews, selling histories and complaints investigations. Our study revealed that many marketplace administrators are eager to present a legitimate, professional space with zero tolerance for fraudulent behaviour, to reassure suspicious fraudsters that they won’t themselves be scammed.
At least 31 major dark web marketplaces have been identified since 2011, with many being closed due to exit scams or the efforts of law enforcement.
Individual marketplaces disappear with some regularity. Sometimes this is due to high-profile takedowns by coordinated law enforcement efforts (like one known market which had been enjoying $12m in monthly turnover before its 2023 demise). Sometimes the owner of a marketplace will take it down unexpectedly, seizing customers’ cash and/or inventory, in a phenomenon known as an exit scam. This institutional instability is understood to be part of the cost of doing business here.
A Professional Supply Chain for Organized Crime
Email accounts and bank accounts, purchased individually or in bulk, are the basic tools of fraud and are often sold at commodity pricing levels. These can vary in quality, from low-detail lists on up to “fullz” (slang for ‘full contacts’ that might contain names, addresses, contact details and even usernames and passwords.) Fraudsters have also learned to package their knowledge into more advanced offerings, often for higher rates, as seen in the pricing examples on this page.
FOR SALE: BASIC FRAUD DATA
Aged email accounts
These higher-value emails can more easily bypass fraud controls, sometimes with the help of included browser fingerprints designed to work in conjunction with cookies and proxies.
Traditional bank accounts
These account numbers might be stand-alone, which are useful to synthetic identity creators, or might be connected to other PII.
Digital-first bank accounts
Access to challenger, cryptocurrency and neo-investment accounts may appeal to savvier customers or may provide better opportunities to see into account balances.
Reward point accounts
Converting rewards points into tickets, vouchers or cash involves more steps, but scamming airlines, hotel operators and cruise lines can be easier than defrauding financial institutions.
FOR SALE: ADVANCED OFFERINGS
Bundled services and tutorials
These all-in-one fraud kits target those new to the fraud game, with packages that buttress product offerings with whitepapers, tutorials and guides and even 1:1 mentorship.
Plug-and-play fraud kits
These pre-configured virtual machines come installed with secure undetectable web browsers designed specifically to evade fraud detection systems.
KYC as a service packages
These help purchasers circumvent advanced onboarding checks by verifying accounts that have not yet passed the KYC stage. They can also enable reactivation of KYC-ready accounts that have been blocked.
High-value business accounts
These are a rarer commodity, but can be helpful for lending a professional sheen to the business of laundering the proceeds of smaller scams.
Fraud In Practice: How Dark Web Resources Can Support All Aspects of an Account Takeover
In 2025, account takeover accounted for more than one in every four fraudulent attacks. Part of why fraudsters have grown so adept at this particular sort of attack is thanks to the step-by-step support they can count on from the dark web.
How the Dark Web is Evolving, And What’s Being Done About It
The dark web has been around for many years now, and it’s evolved over time to try to stay ahead of changing consumer preferences and to avoid the efforts of law enforcement to rein it in. But the tide of the battle is turning at last. Here are some of the major shifts our research reveals.
The currency of choice for the dark web is in flux. Cryptocurrency has long been the dark web’s de facto currency, and newer blockchain-based solutions are giving fraudsters options that are deemed more private and less trackable.
Smaller, more focused marketplaces are becoming the norm. Several high-profile marketplace closings have led dark web sellers to gravitate to more specialized markets that may more easily evade the focus of global law enforcement.
Fraudsters face imposing new obstacles. Fraudsters are vocalizing their frustration in dark web forums about which anti-fraud efforts are pain points for them. These include real-time liveness KYC checks, phone and email risk analysis, account activity checks, device fingerprinting and IP analysis.
Modern identity verification is a problem. Demand is outpacing supply for “verification mules” and deepfakes that can pass advanced KYC checks. Some leverage Generative Adversarial Networks to create video-swapping solutions that try to bypass live verification, but it’s proving quite challenging.
Automating workflows for efficiency. Fraud involves time-consuming, repetitive tasks that agentic AI can now perform, saving fraudsters time and making it easier for new criminals to join the party.
Fraudsters are scamming each other. Sometimes defrauding other criminals can be an attractive option, and dark web admins are kept busy cracking down on shady offerings that are often used to scam other scammers, like cloned credit cards.
Fear of “exit scams” is growing. The risk of investigators shuttering a marketplace hovers over every dark web transaction. Sometimes, fraudsters will close a shop without warning, offering no explanation and no refunds.
The pool of mule candidates is shrinking. Fraudsters may need more mules than ever, but the candidate pool is starting to shrink as recruits grow wary of the growing risks of arrest and long-term credit trouble mule behavior can bring, resulting in chronic mule-network shortages.
Customer satisfaction and positive vendor ratings matter. Many dark web forums have similar reputation systems to “surface web” forums, often with strict moderation and the ability for users to upvote or downvote other users on the basis of good and bad experiences.
Admins are increasingly prioritizing security, to keep the threat of getting scammed from deterring potential customers. Standard practices now include PGP (Pretty Good Privacy) encryption, multi-factor authentication and a reliance on dark web escrow services.
Social Media Platforms Are Now Bringing Fraud-as-a-Service to Criminals’ Fingertips
The Dark Web remains the primary hub of online criminality, but social media messaging
platforms are starting to get a foot in the door. These mobile-first solutions present app-level convenience, presenting an easier arena for criminal customers to operate in and, evidence suggests, attracting a younger audience. Advantages include:
- More favorable ecommerce functionality, e.g. peer-to-peer transactions without paying a dark web administrator’s cut
- Search-engine style functionality (though only inside secret groups) that make fraud solutions more accessible
- Faster connection speeds, comparable to what the “surface web” enjoys but the dark web often lacks
Dark-web style interactions are proliferating across social media messaging platforms at a dizzying rate: Recently, one social platform reportedly used AI to help it remove more than 15m illicit sites in just one industrial-scale shuttering.