"The dark web" suggests one hidden website. Europol describes a scattered trade instead. Its IOCTA 2026 finds that "Dark web marketplaces are increasingly fragmented", and that forums "function as migration hubs after a prominent market is closed down". Its IOCTA 2025 adds that sales of breached data are more and more often negotiated and closed in end to end encrypted (E2EE) apps, and that the same data "may be sold and purchased several times by different criminal actors, or resold after use."
What a launderer wants from this market is an account in someone else's name. Of the three stages of money laundering, such an account serves two: it takes in criminal money at placement and passes it on during layering.
What is sold on the identity data market?
Stolen personal and account data, packaged as products. IOCTA 2025 says information is "stolen and converted into a commodity to be further exploited by other criminal actors", then marketed on specialist marketplaces, underground forums and channels inside encrypted messaging apps. Some of these run on Tor; others sit on the open web.
Each product reaches a regulated firm in its own way:
- Logins. Usernames and passwords for email, social media and online shopping accounts, among others. At a firm they turn into account takeover fraud.
- Card data. Compromised card details, spent through card not present fraud at online checkouts.
- Full identity records. One real person's details sold as a set, which sellers call fullz. At a firm they become applications in that person's name.
- Infostealer logs. What malware lifts from an infected device. Europol says the logs may hold personal data, credentials for various services and browser data, and IOCTA 2026 calls infostealers a key enabler of cyber attacks in 2025, bought by everyone from access brokers and ransomware affiliates to fraudsters.
- Bank accounts and one time password bypass tools. IOCTA 2026 lists both among the fraud tools that smaller dedicated platforms trade. An account opened in another person's name is a ready made money mule account.
- Laundering itself. IOCTA 2025 lists money laundering services among the products on sale, next to VPNs and bulletproof hosting.
One seized forum shows the range. The Justice Department announced the seizure of LeakBase on 4 March 2026. According to an affidavit unsealed on 3 March, the forum had over 142,000 members. The release lists credit and debit card numbers, banking account and routing information, and usernames with their passwords among what it offered, on the open web and in English.
How does a sale of stolen data work in 2026?
Picture a buyer who wants fresh logins (an illustrative case, built from Europol's description). The buyer finds a group selling infostealer logs. It asks to join the group's channel in an encrypted app, where a channel administrator may have to approve the request and invitation links often expire. Access costs a subscription, weekly to annual. Logins the buyer does not use can be sold on to the next buyer.
Card data often changes hands with no conversation at all. IOCTA 2025 describes automated vending carts, websites built for compromised card details, where buyers filter listings and purchase items "without interacting with a vendor".
Where buyer and seller are strangers, someone has to hold the money. The Justice Department alleges that Huione Guarantee, also known as Haowang Guarantee, operated Telegram channels with discussions of illicit products and services, from the sale of stolen credit card and identity information to help with laundering the proceeds of romance and investment scams. It also provided escrow services for criminals transacting on its platforms, according to the same release.
Escrow does not protect buyers from the operators themselves. IOCTA 2026 calls exit scams on dedicated marketplaces "endemic", with administrators planning shutdowns "to disappear with users' funds at the first sign of trouble".
A takedown closes one market at a time. LeakBase's closure took coordinated action by law enforcement in 14 countries on 3 and 4 March 2026, hosted by Europol in The Hague. Europol reports that when forums collapse, successor forums emerge within weeks; DarkForums emerged in 2025 as the successor of BreachForums.
What is stolen identity data worth?
No regulator publishes a price list for stolen identities. Europol's one price line is about access, not single records: in IOCTA 2025, subscriptions to infostealer log channels range "from tens to hundreds of USD", weekly to annual.
Listings mislead as well. IOCTA 2025 warns that many data brokers "overstate the classification or value of their assets", and that their offerings may be fake or tied to outdated leaks. A buyer often cannot tell a fresh record from a recycled one before paying.
For the firm, price is beside the point. A record can be resold after use, so each new buyer gets another attempt at the same person. The cost lands where the identity is used: the loan approved in that name, or the money the account later moves.
What does a bought identity do at onboarding, login and payout?
Table 1. The life of one stolen identity, and where a firm can see it
| Stage | What happens | What the firm sees | Which control can see it |
|---|---|---|---|
| 1. Stolen | Phishing, infostealer malware or a breach takes the data | Nothing | None at the firm |
| 2. Packaged and listed | Data is sorted into logins, cards, full records, accounts | Nothing | None at the firm |
| 3. Sold and resold | Sold by subscription, vending cart or forum, often more than once | Nothing | None at the firm |
| 4. Onboarding | An applicant enters a real person's details | Every field matches; device or location at odds with the documents | Identity verification and device checks |
| 5. Login | Someone signs in to an existing account with valid credentials | Known account, unfamiliar IP address or device | Fraud controls on the session |
| 6. The account moves money | Funds arrive and leave quickly | Rapid flows; similar accounts acting together | Transaction monitoring and mule checks |
| 7. Cash out | Money leaves for exchanges and payment processors | Transfers to services with illicit exposure | Sanctions and wallet screening |
Rows 1 to 3 happen out of sight. Row 4 is where identity theft turns into identity fraud: the data is presented to the firm, and from then on every row leaves a trace in data the firm already holds.
IOCTA 2025 names the uses: "Criminals use stolen personal data to create fake identities, apply for subsidies, loans or credit cards and commit other types of financial fraud." Some records are used whole. Others are mixed with invented details to build a synthetic identity that belongs to nobody.
Row 5 needs no new account at all. LeakBase's usernames and passwords were, in the Justice Department's words, credentials "which could facilitate additional account takeovers". A valid password opens the real customer's account, so a password check alone tells the firm little about who is signing in.
At payout, fraud turns into laundering. In its November 2024 alert on deepfake media, FinCEN reported accounts opened with fraudulent identities, suspected to have been produced with generative AI, that went on to "receive and launder" money from other fraud schemes. An account opened with a bought identity can do the same from its first day.
Rows 4 to 6 show more clearly across accounts than inside any one of them. In the fraud prevention product of complead, formerly Sanction Scanner, accounts linked by a shared device, beneficiary or funding path are resolved together, "so the ring is visible as a ring", and each decision carries its reason.
Why can bought data pass a KYC check?
Picture an applicant at a neobank (illustrative). The name, date of birth, home address and ID number all check out against the records the bank queries, because they belong to a real person. Every field is right, and the person typing them is someone else.
A check that compares data with a source tests the data and says nothing about who holds it. FATF's guidance on digital identity separates identity proofing, which establishes who a person is at enrollment, from authentication, which establishes that the person using the identity is the one who was proofed. Bought data answers the first kind of question and has nothing to offer the second. An electronic ID covers both.
Speed adds pressure. IOCTA 2026 says online fraudsters have learned to abuse the fast onboarding model of neobanks, whose stream of new accounts "places pressure on KYC mechanisms". In its January 2024 analysis of identity related suspicious activity reported in 2021, FinCEN warned that breached personal data, synthetic identities and AI "may further enable bad actors to exploit identity processes more easily, quickly, and inexpensively".
Due diligence at onboarding, remote checks included, stays one of the leading AML duties of a fintech firm at any speed.
How is the market's money laundered?
Europol's IOCTA 2026 names the crypto tools that dark web markets launder through. Coinjoin services, which combine coins from many users into one transaction, "remain a popular mixing solution", especially for vendors on dark web marketplaces. Bridges between blockchains are "the preferred laundering method for ransomware actors and major dark web marketplace administrators" because of their speed, liquidity and relatively decentralized design.
On 26 September 2024, the Treasury Department said a Russian individual had served, through payment processing services including one doing business as UAPS, as the payment processor for fraud shops, among them Genesis Market, designated by OFAC, whose website law enforcement took down in 2023. OFAC designated the exchange Cryptex, which Treasury associated with over $720 million in transactions to services frequently used by ransomware actors and cybercriminals based in Russia, including fraud shops, mixing services and exchanges lacking KYC programs. FinCEN identified the exchanger PM2BTC as being of "primary money laundering concern" in connection with Russian illicit finance.
Some markets do not hide at all. In its final rule against Huione Group, effective 17 November 2025, FinCEN assessed that Haowang Guarantee deals in illicit goods and services "in a manner similar to a darknet market but on the open internet".
On 10 November 2026, FinCEN published an order against MEXC Global prohibiting certain transmittals of funds involving the exchange. FinCEN found it had facilitated activity by Russian darknet markets, among other illicit activity, and assessed that at least USD 1.99 billion tied to illicit cyber actors moved through it between May 2021 and May 2026.
These names are counterparties to check before money reaches them. The screening data in complead numbers 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Cryptex, an exchange designated by OFAC, is found there by name. Wallet addresses need a separate crypto wallet AML check. For exchanges themselves, the AML rules for crypto firms put due diligence first among the leading duties, the program Treasury's "exchanges lacking KYC programs" do without.
Which red flags point to a bought identity?
FinCEN's November 2024 alert on deepfake media lists account indicators that warrant further due diligence and red flags seen during verification. FinCEN wrote them for accounts opened with fake identity documents, and they fit any account opened in another person's name, a bought identity included. When a customer's data turns up for sale, they are also the first review, after a step up in authentication at the next login:
- Access from an IP address inconsistent with the customer's profile. The session comes from somewhere the real person does not.
- Coordinated activity among multiple similar accounts. Identities bought in bulk can be worked by one operator, so the accounts move alike.
- Rapid transactions by a newly opened account. The account was opened to move money, not to keep it.
- Withdrawing funds immediately after deposit. Money that passes straight through marks a mule account.
- A third party webcam plugin in a live verification check. FinCEN notes such a plugin can let a customer show previously generated video instead of live video.
- Location or device data at odds with the identity documents. The papers say one person; the device and location say another.
No single flag proves the case: FinCEN tells institutions to consider the surrounding facts and circumstances. When a firm files a SAR on activity the alert covers, FinCEN asks it to include the key term FIN-2024-DEEPFAKEFRAUD in SAR field 2 and in the narrative.
Is it illegal to buy or sell stolen identity data?
In the US and in England, Wales and Northern Ireland, trading in it is a crime under the conditions each law sets. Section 1029 of Title 18 of the US Code makes it a federal crime, where the offense affects interstate or foreign commerce and is done knowingly and with intent to defraud, to traffic in or use unauthorized access devices and so obtain $1,000 or more in value within one year, or to possess fifteen or more of them. Access devices include card numbers, account numbers and codes.
In England, Wales and Northern Ireland, it is an offense under section 7 of the Fraud Act 2006 to make, adapt, supply or offer to supply any article knowing it is designed or adapted for fraud, or intending it to be used for fraud. Section 8 defines an article, for those offenses, to include "any program or data held in electronic form".
Which 2026 seizures and US orders reached the identity trade?
- 4 March. The Justice Department announced the seizure of LeakBase, after action by law enforcement in 14 countries on 3 and 4 March.
- 23 June. The Justice Department seized a cloud computing account that, according to court documents, was used to help operate Huione Guarantee. The same day FinCEN issued a proposal, published on 25 June, to widen its Huione Group definition to one more company and to successor entities.
- 2 August. Comments on that proposal closed after an extension. No final rule had been published as of November 2026.
- During 2026. Europol published IOCTA 2026, with fragmented markets and pressure on neobank onboarding among its findings.
- 10 November. FinCEN's order against MEXC Global was published. It takes effect on 10 December 2026.
Once a bought identity has opened the account and money from other frauds has arrived in it, that money still has to be cleaned online, through mixers, bridges, exchanges and payment processors, before it can be spent. That route is cyber laundering.
