Your verified customers are for sale: The rise of account farms

Account farms are proliferating, offering illicitly obtained online user profiles for sale. These fake or stolen profiles, created through account farms, are advertised on standalone websites and channels, akin to commercial products. Resistant AI, a firm specializing in document fraud detection and transaction monitoring, has identified over 100 such sites and more than 50 Telegram channels advertising access to various platforms, including banking apps, crypto exchanges, remittance services, and online marketplaces.

Listings can involve hundreds of thousands of accounts, with an average price of approximately $344 per account.

Account farms often include supplementary documentation such as proof of address, income, sources of wealth, or business records to maintain the illusion of legitimacy. Sellers employ various tactics to package these accounts, including reselling verified account data, assembling synthetic identities from breached data, and crafting entirely fabricated personas using generated documents. For businesses, shell registrations, forged incorporation papers, or claims of ownership over existing companies are utilized.

The rise of account farms poses a significant threat across sectors, exploiting vulnerabilities in platforms that prioritize low-friction onboarding. Neobanks, for instance, are particularly susceptible due to their emphasis on rapid account creation. Similarly, remittance services benefit from lighter checks on the receiving end, facilitating the illicit transfer of funds. Regardless of the sector, the scale and interconnectedness of these networks render account farms highly valuable to fraudsters.

Detecting account farms requires a multi-faceted approach. Institutions must scrutinize proof of address and income documents, focusing on forgery detection. Additionally, they should monitor for serial fraud, such as using the same document across multiple applications, and near-identical company names within their databases. Accounts created in batches from shared devices, locations, or repeated security questions are also red flags.

AI-powered tools, such as Resistant AI's document fraud detection software, can analyze documents and compare them against a vast database, irrespective of document type, language, or country of origin.

However, genuine customer account sales present a challenge. Authentic documents are typically flawless, and a document check yields no results. In such cases, transaction monitoring becomes crucial, identifying suspicious patterns outside the application package. The market for verified accounts persists because onboarding controls can be breached at scale. Institutions must remain vigilant, adopting proactive measures to counteract this growing threat.