Account farms, which involve the creation of fake, synthetic or stolen online user profiles, now sell consumer and business accounts through standalone websites — priced and packaged like a product.
One company working to detect account farms is Resistant AI, a document fraud detection and transaction monitoring software company which uses AI to uncover hidden document fraud, financial crime and money laundering.
The platform’s threat intelligence team found more than 100 standalone sites and more than 50 Telegram channels falsely advertising access to a range of platforms, from mainstream banking apps to crypto exchanges, remittance services and online marketplaces.
Product listings ran into the hundreds of thousands, and more than 3k institutions were affected. The average listing price was about $344.
Inside the account package
A sale rarely stops at basic login credentials. To ensure accounts continue to look legitimate under scrutiny, the purchased package often includes supporting paperwork like proof of address, proof of income, sources of wealth documents or business records.
Because these accounts are explicitly built to bypass checks such as Know Your Customer (KYC) and Know Your Business (KYB), sellers use a few different methods to package them.
With consumer accounts, the majority appear to be willing money mules reselling their own verified account data.
But there’s also the possibility of synthetic identities assembled from breach data and entirely fake personas assembled from generated documents.
Business accounts come from shell registrations, forged incorporation papers, or claims of ownership over companies that already exist.
When fraudsters don't use real documents from people willing to resell, they often turn to template farms — websites that sell ready-to-edit official layouts.
Resistant AI has logged tools that allow sellers to swap faces on selfies and bypass motion checks using deepfakes. If technical evasion fails, the seller can often just message the original reseller to provide the necessary live proof on demand.
Is your industry under attack?
Account farming reaches across sectors, and each type of platform is vulnerable for a different reason.
For example, neobanks are exploited because they value low-friction speedy onboarding, so once a weakness is discovered it can be exploited just as quickly. Meanwhile, in remittance services, lighter checks on the receiving side make offloading illicit funds straightforward.
Whatever the sector, the scale of the networks is what makes these account farms so valuable. For example, authorised push payment (APP) fraud for banks and payment providers needs thousands of accounts to layer funds through, and account farms supply them.
What to look for
Institutions often overemphasise the importance of identity documents. Proof of address and proof of income files are reviewed less rigorously than IDs, which is exactly why forgers target them.
Inspecting these documents more thoroughly (with the right tooling) is the first step.
Beyond that, look for criminals using the same document across multiple applications (a pattern Resistant AI calls 'serial fraud'), near-identical company names already inside your own book and accounts created in batches from shared devices, locations or repeated security answers.
AI powered tools like Resistant AI document fraud detection software analyses documents and compares them against every other submission, regardless of document type, language or country of origin.
Genuine documents are the harder case. When a real customer sells their own verified account, the paperwork is authentic and a document check has nothing to find, so the evidence moves to behaviour. That is where transaction monitoring earns its place, catching suspicious signals outside the application package.
The market for verified accounts exists because onboarding controls can be tested, repeated and beaten at volume. What is your institution doing to combat it?
