Research reveals a surge in online marketplaces selling fake, synthetic, and stolen identities, exploiting weaknesses in onboarding controls and leveraging AI-driven document fraud tools to evade detection.
Account farms are turning the sale of fake, synthetic and stolen identities into a brisk online trade, with marketplaces now offering consumer and business profiles much like any other digital product. Research from Resistant AI suggests the scale is substantial: its threat intelligence team found more than 100 standalone websites and over 50 Telegram channels advertising access to banking apps, crypto exchanges, remittance services and online marketplaces, with hundreds of thousands of listings and more than 3,000 institutions affected.
The operation rarely ends with a username and password. According to Resistant AI, sellers often bundle accounts with supporting paperwork such as proof of address, proof of income, sources of wealth files or business records, all designed to help the profile survive identity checks. In practice, that can mean resold verified accounts from willing money mules, synthetic identities built from breach data, or shell companies and forged incorporation papers used to open business accounts.
The fraud is especially difficult to stop because it exploits weaknesses in onboarding controls, particularly know your customer and know your business checks. Resistant AI says template farms now sell editable official-looking layouts, while some sellers use deepfakes to swap faces on selfies or defeat motion checks. If technology fails, an original reseller can simply be asked to provide live proof on demand, allowing the fraud to continue.
Industry reports from Finextra and BankInfoSecurity say AI-driven document fraud tools are increasingly being used to spot inconsistencies, tampering and synthetic identities during account creation. But Resistant AI argues that document checks alone are not enough: when genuine customers sell their own verified accounts, the paperwork can appear real, leaving behavioural clues and transaction monitoring to do the heavy lifting. The company says institutions should look for repeated document use, near-identical company names, and batches of accounts created from shared devices, locations or security answers.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
