Your verified customers are for sale: The rise of account farms

Verified accounts are no longer just something criminals trade in dark corners. Resistant AI says they are now being sold through standalone websites, packaged like ordinary products and aimed at consumer and business platforms alike.

The company’s threat intelligence team found more than 100 of these sites and more than 50 Telegram channels advertising access to banks, crypto exchanges, remittance services and online marketplaces. The listings ran into the hundreds of thousands, affected more than 3k institutions, and averaged about $344 apiece.

And the sale often goes far beyond a username and password. Buyers can get proof of address, proof of income, sources of wealth papers or business records — the kind of material meant to survive KYC and KYB checks. Consumer accounts are often tied to money mules reselling their own verified data, but the source notes that some are synthetic identities built from breach data or fully fake personas stitched together with generated documents.

Business accounts follow a similar playbook, only with sharper edges. Some come from shell registrations or forged incorporation papers, while others claim ownership over real companies. Where fraudsters can’t get genuine documents from willing sellers, they may rely on template farms that sell editable official layouts, or tools that swap faces on selfies and beat motion checks with deepfakes. If that still fails, the original reseller can be pinged to provide live proof on demand.

The reason this market works is simple: onboarding controls can be tested, repeated and beaten at scale. Neobanks are attractive because they prize fast, low-friction sign-up, while remittance services can be easier places to move illicit funds through the receiving side. For banks and payment providers, the problem is bigger still: APP fraud often needs thousands of accounts to layer money through, and account farms can supply them.

Resistant AI says institutions lean too hard on identity documents and not hard enough on the supporting files around them. It recommends closer review of proof of address and proof of income, along with checks for repeated use of the same documents, near-identical company names, and accounts created in batches from shared devices, locations or security answers. When the paperwork is real because a real customer sold the account, the trail shifts from documents to behavior — which is where transaction monitoring has to do the heavy lifting.