The Dark Web Has a New Business Model

Somewhere on a Tor-obscured server, a fraudster just saved USD800. They didn't crack your security stack or social-engineer a help desk agent. They simply logged onto a marketplace, paid the equivalent of a decent restaurant meal for a KYC-as-a-service package (fake identity, stolen credentials, bypass tutorials included), and started opening bank accounts in your customers’ names.

Welcome to the industrialization of fraud.

The dark web has undergone a quiet but seismic transformation. What began as a niche corner of the internet populated by drug dealers and hackers has matured into a full-service criminal infrastructure. It’s one that LexisNexis Risk Solutions' 2026 Global State of Fraud and Identity Report describes as a “comprehensive fraud-as-a-service marketplace.”

The numbers are staggering: daily Tor users surged from 3 million in 2024 to 4.6 million in 2025 via just one browser. At least 31 major dark web marketplaces have been identified since 2011. And according to research from SQ Magazine, dark web activity is estimated to generate around USD3.2 billion in annual revenue globally — with fraud and scam services alone accounting for USD520 million of that.

For CISOs, this is a threat landscape that’s moving at hyperspeed.

Fraud, priced to move

The dark web's evolution mirrors legitimate e-commerce in disturbing ways. There are storefronts, customer reviews, and even money-back guarantees (occasionally honored). The product catalog would make a compliance officer’s blood run cold.

According to the LexisNexis report, aged email accounts (those with enough history to pass behavioral analytics) sell for just USD3-5 apiece. Digital-first bank accounts, already verified and fraud-ready, go for USD300-900. High-value business accounts can fetch USD1,000-2,000. Bundled fraud kits, with everything a novice criminal needs to get started, run about USD200. Want to outsource the identity verification problem entirely? KYC-as-a-service packages are available for USD500-800, complete with human “verification mules” who will perform live liveness checks on your behalf.

The price list has a strategic story: Criminals aren’t just buying data anymore; they buying operational infrastructure. The marketplaces even offer mentorship programs and tutorial videos, creating, the report says, a “cottage industry of amateur fraudsters” and lowering the barrier to entry for financial crime to levels never before seen.

The arms race nobody warned you about

The dark web's forums double as a real-time feedback loop on your defenses. Fraudsters openly discuss which liveness checks they've beaten, which device-fingerprinting tools have blind spots, and which IP-analysis engines are failing to flag VPN traffic. Trend Micro's research confirmed that open-source deepfake tools (freely available, user-friendly) successfully defeated at least two major KYC providers in testing. Bypass-as-a-service packages are now available on underground markets for as little as USD30.

Deepfake attacks have grown by more than 2,000% over the past three years, according to KYC-Chain research, now representing roughly one in fifteen identity fraud attempts. A deepfake attempt occurs approximately every five minutes. The technology has outpaced the defenses designed to stop it: passive liveness checks that require a blink or a head turn are, according to Trend Micro, effectively broken against determined attackers.

The LexisNexis report notes that demand for “verification mules,” real humans who perform live biometric checks on behalf of fraudsters, is now outpacing supply. The most sophisticated attack on your liveness detection isn't a deepfake but someone getting paid USD20 to smile at a camera.

The hydra problem is real

Law enforcement isn't sitting idle. Operation RapTor in May 2025 resulted in USD200 million seized, 270 arrests, and two tons of drugs off the street. In a single industrial-scale shutdown, one social media platform removed more than 15 million illicit fraud-related sites.

And yet the LexisNexis report notes that regulators reliably close marketplaces only to watch replacements emerge almost immediately. Research tracking dark web markets found the average marketplace lifespan is now just 7.5 months, meaning the ecosystem has adapted to law enforcement pressure by becoming more resilient through faster turnover. Exit scams (marketplace administrators vanishing with customers' crypto) are endemic, but they barely slow the overall ecosystem down.

The hydra analogy may be overused in cybersecurity, but here it's accurate.

The tale of two timelines

The LexisNexis data reveals something counterintuitive: fraudsters are prolific complainers. Underground forums are full of posts about which controls actually slow them down — real-time liveness with micro-muscle-movement analysis, phone and email risk scoring at onboarding, device fingerprinting layered with IP reputation, velocity checks that flag account creation patterns. These aren't invincible but then nothing is. Yet, they generate enough friction to make criminals vent publicly about it, which is, functionally, a threat intelligence feed hiding in plain sight.

Worth noting is that 42.5% of fraud attempts now deploy AI, with 29% successfully breaching defenses. The fraud economy moves on venture-style timelines — rapid iteration, market feedback, and ruthless abandonment of what doesn't work. Most enterprise security programs move on procurement timelines.

That gap is the product dark web marketplaces are actually selling.

Image credit: iStockphoto/Denis Novikov