Fraud Basics
Intro to Criminal Infrastructure
Understanding the underground fraud economy: dark web markets, criminal tools, and how fraud operations are organized
For education only. We do not guarantee that this guide is accurate, complete, or up to date. Research the topic yourself and check current, reliable sources before acting.
In this guide
Criminal infrastructure refers to the marketplaces, tools, and specialists that enable modern fraud at scale. Card vendors, tool makers, money launderers, and cash-out crews each handle one part of an operation, then sell their output to the next link in the chain. This article walks through how the ecosystem works, who plays which role, and why shutting down individual actors rarely disrupts the system.
It started with a chargeback. Customer in Ohio claimed she never made a $47 purchase from an electronics retailer in Miami. Standard stuff.
Marcus pulled the transaction data. Shipping address was different from billing. Email domain looked strange. He flagged it and moved on.
A week later, a pattern emerged. Fourteen more chargebacks with the same characteristics. Different cards, different cardholders, but all shipping to addresses within a three-mile radius of each other. The email addresses followed a template: random words, underscore, two digits, all at the same obscure domain.
He started digging. The IP addresses traced to residential proxies. Device fingerprints showed virtual machines. Phone numbers used for verification were VoIP. Every piece of data that should have been unique was manufactured.
This wasn't fourteen separate fraudsters. This was one operation using fourteen stolen identities.
Somewhere out there was a marketplace that had sold them everything they needed: the card numbers, the personal information to pass verification, the tools to mask their location, and the network of addresses to receive the goods.
This story is fictional, but the patterns are real.
Why This Matters
In the previous articles, you learned about fraud types and how attacks work. But here's what most people miss: modern fraud isn't a solo act. It's a supply chain.
The person who steals your credit card number probably isn't the person who uses it. The hacker who breaches a database probably doesn't know how to cash out. The scammer on the phone probably bought their script from someone else.
Understanding this ecosystem matters because it explains why fraud keeps growing despite better security. When one operation gets shut down, the suppliers just find new customers. When one vulnerability gets patched, the toolmakers adapt. The infrastructure persists even as individual actors come and go.
The Criminal Marketplace Ecosystem
How do criminal markets work?
Criminal marketplaces operate like any e-commerce site. They have storefronts, product listings, customer reviews, escrow services, and even customer support.
In June 2025, U.S. authorities seized approximately 145 domains belonging to BidenCash, a marketplace that had been operating since 2022. The numbers tell the story of an organized business: over 117,000 customers, more than 15 million payment card numbers traded, and over $17 million in revenue.[1]
BidenCash wasn't unusual in its structure. It was unusual only in getting caught.
These markets typically offer:
| Category | What's Sold | How It's Used |
|---|---|---|
| Payment data | Stolen card numbers with CVV | Direct purchases or resale |
| Fullz | Complete identity packages (SSN, DOB, address) | Account opening, loan fraud |
| Account access | Login credentials, session tokens | Account takeover |
| Tools | Checkers, proxies, fake ID templates | Operational support |
| Services | Money laundering, cash-out crews | Monetization |
What does stolen data cost?
Pricing follows supply and demand, just like legitimate markets. A basic U.S. credit card number with CVV runs $10 to $40. Cards with high limits (over $5,000) fetch $110 to $120. Bank login credentials cost $200 to $1,000 or more, depending on the account balance.[2]
"Fullz" packages, which include name, Social Security number, date of birth, and sometimes a driver's license scan, sell for $20 to $100 or more. The more complete the package, the more fraud it enables.
Fresh data commands a premium. Immediately after a major breach, high-quality records sell at top prices. But the market floods quickly. Within weeks, those same records become a low-cost commodity as thousands of copies circulate.
The Specialization Economy
What makes criminal infrastructure so resilient is specialization. Each role in the supply chain focuses on what they do best.
Data suppliers harvest stolen credentials through breaches, phishing, skimming devices, or infostealer malware. They sell raw data in bulk.
Processors take raw data and enrich it. They run card numbers through "checkers" to verify which ones still work. They match partial records to build complete identity profiles. They package data for specific use cases.
Tool makers build the technology. Proxy networks that mask location. Virtual machine configurations that evade device fingerprinting. Bots that automate account creation. Templates for fake identity documents.
Operators execute the fraud. Some specialize in card-not-present purchases. Others run social engineering campaigns. Some coordinate networks of money mules to move funds.
Cash-out specialists turn stolen value into spendable money. This might involve purchasing gift cards, buying and reselling merchandise, converting cryptocurrency, or running funds through shell companies.
No single person needs to master every skill. The marketplace connects specialists, each taking a cut of the final profit.
How do fraudsters move stolen money?
Getting money out is often the hardest part. Stolen card numbers are worthless if you can't convert them to cash.
Common cash-out methods include:
Reshipping networks: Operators purchase goods with stolen cards and ship them to "drops," addresses controlled by money mules who forward packages overseas. The mules often don't know they're participating in fraud.
Gift card laundering: Purchase gift cards online, sell them on secondary markets at a discount. The buyer gets a bargain; the seller converts stolen payment credentials into untraceable cash.
Cryptocurrency mixing: Convert stolen funds to cryptocurrency, run them through "mixers" or "tumblers" that blend transactions to obscure the source, then cash out through exchanges with weak verification.
High-risk merchant accounts: Some merchants knowingly or unknowingly process fraudulent transactions. The funds settle to a bank account before chargebacks arrive, then disappear.
Reconstructing these flows is its own discipline. See Money Movement Investigation for the techniques investigators use to trace stolen funds back through mules, mixers, and shell accounts.
The Role of Platforms
Until recently, criminal marketplaces operated primarily on the dark web, requiring specialized software to access. That's changing.
Telegram has become a major hub for fraud services. Channels advertise stolen data, hacking services, and fraud tools. The platform's perceived privacy and ease of use make it attractive, though Telegram has stepped up enforcement in response to pressure.
Huione Guarantee, operating under a Cambodian financial conglomerate, aggregates Telegram channels offering everything from stolen personal data to money laundering services and deepfake tools.[3] Cambodia's National Bank revoked its banking license in March 2025 following international pressure.
The platforms shift, but the infrastructure adapts. When one channel gets shut down, operators move to another. When one marketplace gets seized, competitors absorb its customer base.
How big is the fraud economy?
The FBI's Internet Crime Complaint Center reported $16.6 billion in cybercrime losses in 2024, with fraud accounting for $13.7 billion of that total.[4] Cryptocurrency-related fraud alone reached $9.3 billion, a 66% increase from 2023.
These numbers only capture reported losses in the United States. Global estimates are harder to pin down, but industry reports suggest fraud costs exceed $1 trillion annually.
The scale explains why the infrastructure persists. With that much money flowing, there's enormous incentive to innovate, specialize, and professionalize.
Key Takeaways
- Fraud operates as a supply chain with specialized roles: data suppliers, tool makers, operators, and cash-out specialists
- Criminal marketplaces function like legitimate e-commerce, with storefronts, reviews, escrow, and support
- Stolen data pricing follows supply and demand; fresh data commands premiums while breached records become commodities
- The infrastructure's resilience comes from specialization; shutting down one actor doesn't disrupt the supply chain
- Platforms shift from dark web to Telegram to gray-market hubs, but the underlying economy adapts
Key Terms
| Term | Definition |
|---|---|
| Carding | Using stolen payment card data for unauthorized purchases |
| Fullz | Complete identity package including name, SSN, DOB, and often more |
| Checker | Tool that tests stolen card numbers to verify which are still active |
| Drop | Address used to receive goods purchased with stolen credentials |
| Money mule | Person who moves fraudulent funds, often unknowingly |
| Escrow | Third-party service holding payment until buyer confirms goods |
| Mixer/Tumbler | Service that blends cryptocurrency transactions to obscure origins |
| Proxy | Server that masks the user's real IP address and location |
| Infostealer | Malware that harvests credentials and personal data from infected devices |
| Cash-out | Converting stolen value (cards, credentials, access) into spendable money |
References
1. BleepingComputer: BidenCash carding market domains seized in international operation (June 2025)
2. DeepStrike: Dark Web Data Pricing 2025
3. Recorded Future: How Huione Marketplace Fuels Global Cyber Fraud
CHECK YOUR UNDERSTANDING
Criminal Infrastructure Quiz
1. A dark web marketplace advertises "verified fullz" with seller ratings, buyer reviews, and a 48-hour escrow period. A new fraud analyst on your team asks why criminals would build such elaborate systems. What's the best explanation?
- Criminals are mimicking legitimate businesses for fun
- These markets solve the same trust problems as Amazon or eBay: helping buyers find sellers, verify quality, and transact safely without trusting each other directly
- Law enforcement requires them to have escrow systems
- The escrow system is actually a scam to steal from other criminals
Show answer and explanation
These markets solve the same trust problems as Amazon or eBay: helping buyers find sellers, verify quality, and transact safely without trusting each other directly
Criminal marketplaces provide discovery (finding what you need), reputation (knowing sellers deliver), and escrow (ensuring payment only after delivery). These mirror legitimate e-commerce because criminals face the same trust challenges as any marketplace.
2. Your threat intelligence feed reports that a major carding site just released 2 million stolen card numbers for free. Your fraud team should expect what in the next 48-72 hours?
- Nothing unusual, since the cards are probably expired
- A surge in card-testing and fraudulent purchase attempts as criminals validate the free data
- A decrease in fraud because criminals will be busy downloading the data
- Only ATM fraud, since the dump only contains magnetic stripe data
Show answer and explanation
A surge in card-testing and fraudulent purchase attempts as criminals validate the free data
Free data dumps act as marketing campaigns in the criminal ecosystem. They drive a wave of activity as criminals test and use the cards. Understanding this pattern helps fraud teams proactively tighten controls before the surge hits.
3. During a fraud investigation, you trace stolen credit cards back to a data breach, find them listed on a dark web market, and identify they were used with residential proxy services to avoid detection. Your report maps this as a "supply chain." Why is this framing useful?
- It makes the report look more professional for law enforcement
- It identifies multiple disruption points: cut off data supply, take down the market, or block the proxy infrastructure
- Supply chain is just a buzzword that doesn't add analytical value
- It helps calculate the exact dollar amount of losses
Show answer and explanation
It identifies multiple disruption points: cut off data supply, take down the market, or block the proxy infrastructure
Thinking of criminal infrastructure as a supply chain (inputs, platforms, outputs) reveals that disrupting any link weakens the whole operation. You don't have to catch every fraudster if you can cut off their tools, data sources, or distribution channels.
4. An analyst discovers that a fraud ring is using a "fraud-as-a-service" platform that provides phishing kits, residential proxies, and SMS verification bots in one subscription. Which layer of the criminal ecosystem does this platform represent?
- Vendors who steal the original data
- Operators who carry out individual attacks
- Tool makers who build and sell attack infrastructure
- Cash-out specialists who convert stolen funds to real money
Show answer and explanation
Tool makers who build and sell attack infrastructure
The criminal ecosystem has distinct layers: data suppliers steal information, tool makers build attack platforms, operators execute attacks, and cash-out networks convert gains to usable money. Fraud-as-a-service platforms are built by tool makers who profit by selling capability to operators.
5. Your company just appeared in a news article about a data breach. Based on how the criminal underground operates, what should your fraud team prioritize in the next few weeks?
- Hiring more customer support staff for breach notification calls
- Monitoring for compromised credentials appearing on dark web markets and increasing authentication challenges for affected accounts
- Reducing marketing spend until the news cycle passes
- Switching to a new payment processor
Show answer and explanation
Monitoring for compromised credentials appearing on dark web markets and increasing authentication challenges for affected accounts
Stolen data follows a predictable path: breach, appearance on markets, then exploitation. By monitoring dark web markets for your data and proactively strengthening authentication on affected accounts, you can disrupt the supply chain before fraud materializes.