Fraud on the Dark Web – February 2021

Last updated: February 19, 2021

Fraud on the Dark Web – February 2021

Last updated: February 19, 2021

The PDA Fraud on the Dark Web – February 2021 bulletin has been released.

This quarterly bulletin looks at how changes in the dark web landscape affects the sale of fraud items and services.

This quarter we’ve seen a major market ‘exit scamming’, a flood of new fraud templates and significant fluctuations in pricing. See the full report below. 

If you are interested in learning how to investigating fraud on the dark web, take a look at our online course ‘Investigating Fraud on the Dark Web’

Key points and developments:

  • There were roughly 13,306 adverts for fraud-related items available in February 2021. This is slightly lower than in October 2020.
  • The three main markets identified for selling fraud items were ‘White House Market’,‘DARKODE’ and ‘Torrez’. 
  • Compromised accounts make up for the most advertised fraud item with roughly 6240 adverts, followed by fake identity documents (1602 adverts) and stolen personal information (2,000 adverts)
  • DarkMarket has recently closed/exit scammed – the next largest market is DARKODE, and has been steadily gaining popularity.
  • A sharp rise in ‘checking services’ (such as Criminal Background, Credit and Passport checks) has been seen.
  • The average cost of tutorials has dropped sharply, although most are poor quality.

Average Price Across Markets

ItemAvg. priceChange
Credit cards£20-£4
Fraud Tutorials£9-£39

Feb ’21 – Item cost by quarter

Due to the change in markets, it is difficult to accurately assess price trends. Whilst there seems to be a drop in prices across the board, the sharp drop in tutorial cost is due to DARKODE being flooded with a large number of cheap (and poor quality) tutorials.

Feb ’21 – Advert by type

Compromised accounts made up the majority of items for sale in February 2021, followed by Databases/PII and thenCards/CVVs.

Many databases are old ones being resold, with many freely available elsewhere.

Templates are popular across all marketplaces and have improved in quality, even since last quarter.

Feb ’21 – Advert types by marketplace

Compromised accounts are most popular on ToRRez and WHM, followed with leaked database. WHM has seen a surge in fake documents, many of which are of a very high quality.

DARKODE has a much smaller number of accounts than the other sites, likely due to it being a newer marketplace.

Feb ’21 – Advert types by quarter

The closing of DarkMarket makes it difficult to compare quarters, however we can see a steady rise of compromised accounts for sale, and roughly similar levels for other commodities.

Examples – Dark Web Market Adverts February 2021

An advert for a Credit Report template – these are good quality, and allow for easy, guided editing using Adobe Photoshop.

A similar advert for a UK passport template. This advert highlights the template’s use for verification.

This advert is for mixed credit and debit cards – this means the buyer will not know exactly what they are getting and has to trust on the sellers reputation. 

This shows that there is still very much a market for fake physical driving licenses, and they are significantly more expensive than digital documents/templates.

Learn More

Peter Darby Associates (PDA) is a specialist counter fraud training and consultancy company founded byPeter Darby. 

We offer specialist online training in Investigating Fraud on the Dark Web, Digital Document Forensics andOpen Source Intelligence as well as a number of blended and classroom taught Counter Fraud Courses,including Accredited Counter Fraud Specialist Programmes. 

To find out more contact Peter at: