What Does A Refund Promise Cover?
Refund eligibility, failed linking and expiry change the advertised terms attached to card material.
Read the card comparison →
Brandefense Cybercrime Report 2026 · Fraud
1 January–27 October 2026 · Research edition 1.0
Inside The Fraud Service Economy.
Stolen-card ads attach conditions to refunds. Phishing ads seek more than passwords. Account and identity offers add people, access and documents. We compare what these recorded offers promise, and what the evidence supports.
Retained financial-account posts 831 of 2,448
retained financial-account posts match one narrow recruitment signature (33.9%)01The evidence
One Recruitment Pitch. Hundreds Of Records.
A narrow cash-withdrawal recruitment signature appears in 831 of 2,448 retained financial-account posts. The volume of the message is measurable; the number of people behind it is not.
26,718 distinct retrieved post IDs across seven query sets
11,540 distinct records surviving the initial filters; not verified offers
36 selected catalogue entries reviewed in full text, with explicit limitations
Repeated wording · monthly
Matched recordsThe same narrow signature appears across six months.
Counts in the retained financial-account sample. This is the distribution of matched records, not a market trend.
Feb 55
Mar 243
Apr 196
May 212
Jun 120
Jul 5
Records matching the cash-withdrawal pattern
831 of 2,448 retained financial-account post IDs (33.9%) across 132 source channel names. Shared wording does not identify a shared actor.
Source: Brandefense Blackhole, 1 Jan–27 Oct 2026. Sampled records, not a volume trend. Shared text does not establish unique offers or transactions.
Download monthly dataCSV · 83 BOriginal chartSVG · 93.5 KB
+View as table
| Month | Matched records |
|---|---|
| 2026-02 | 55 |
| 2026-03 | 243 |
| 2026-04 | 196 |
| 2026-05 | 212 |
| 2026-06 | 120 |
| 2026-07 | 5 |
Our observation
Different texts can carry the same conditions.
All 831 complete texts differ, even after the stated normalization. Three specific recruitment phrases appear in every one. The 132 recorded source names describe placements, not people.
Follow the repeated recruitment pitch →02The investigations
Who Does The Work? What Is Being Promised?
Explore card material, phishing methods, account participation, identity packages and provider roles. Each investigation answers a different question from our saved records.
From the evidence · 24 July 2026
Travel. Meals. Accommodation.
A rental ad offers to cover all three, alongside a payment per account. The participant’s presence is part of the proposition.
Inspect the recorded offer ↗Advertised terms in FR-O032. No rental, payment or account use was verified.More Than A Password.
The selected offers describe different access goals, including card information, session material and wallet-recovery phrases.
Compare the access claims →Why Cover Travel And Accommodation?
A rental advertisement budgets for a person’s presence. Other offers seek bank relationships and in-person work.
Read the account investigation →Who Does the Technical Work?
Source code, hosted access and separately billed support describe different responsibilities for the seller and customer.
Read the service comparison →831 Different Texts. The Same Stated Conditions.
Every full text is different. Three recruitment phrases recur in all 831 records, and exact-text deduplication removes none.
Inspect the new comparison →The Claim That the Pieces Fit.
A document menu, a same-person bundle and an email-access claim make different promises about identity and control.
Read the identity investigation →Cybercrime Report 2026 / Cross-chapter analysis
Who Does the Work, and Who Keeps Control?
Compare hosted services, worker accounts, access transfer and account-data requests in our cross-chapter analysis.
Explore the work and control analysis ↗03Cards & phishing
Card Material. Phishing Access.
A card-data offer and a phishing service raise different questions. Our new comparisons follow the promised usable state, the interaction requested and the limits in the seller’s own wording.
A Refund Promise Has Conditions.
One card-data ad separates refundable and non-refundable stock, then discounts material near expiry. Other ads tie a remedy to failed linking or state a five-minute check window.
These terms describe what the seller claims to cover. They do not verify usable cards, a delivered refund or the number of stolen cards in the market.
The “Bypass” Claim Still Needs The User.
A phishing ad promises broad two-factor bypass, yet describes waiting for the user’s approval or SMS. Other offers name card information, session material and wallet-recovery phrases.
The message channel, imitated service and access sought are separate parts of the claim. None of these advertisements establishes that a control was defeated.
04The offers
What Is Actually Being Offered?
These selected records put the distinctions in view: software and support, identity components and matching claims, account access and participant recruitment. Separate supplements cover card material and phishing methods. None was purchased or tested.
8 of 8 examples
Phishing2026-05-16
Browser-based phishing package
Source, one-device binary and support priced separatelyThe post calls the lower paired figures launch discounts. Two months of support are included, then $100 per month. The source and binary packages are different entitlements. Setup help is advertised, and the post lists requirements for running the delivered package.
What the record showsThe advertisement separates editable source, a one-device executable and later support charges.
What remains unverifiedNo bypass claim was tested; universal authentication-bypass claims are not accepted as fact. Old and promotional prices are not interchangeable.
Phishing2026-10-21
Hosted phishing dashboard, October offer
$250/7 days; $480/14 days; $940/30 daysOne subscription is said to include all advertised templates. A free 24-hour trial is advertised. Messaging is described as separately billed per segment, without a stated segment price. The post says browsers run on the provider’s servers and customers need not manage those servers.
What the record showsA hosted-dashboard post sells time-limited access and advertises an included template library and optional messaging.
What remains unverifiedNeither template count, trial delivery nor functionality was independently verified. This is one dated offer, not a market price.
Phishing2026-06-29
Hosted dashboard and licence-key bundle
Price not statedDashboard access, a personal licence key and support are bundled. The post says the customer need not supply a server or domain.
What the record showsA short advertisement sells a hosted bundle with a licence key and support.
What remains unverifiedNo earning claim, customer count or operational capability is verified.
Identity2026-03-03
Identity documents and selfie add-on menu
$10 scan; $15 with selfie; $20 address proof; $30 bill templateThe post lists separate document, selfie, address-proof and template options. The fullz line is a $7–25 range.
What the record showsA compact menu prices identity components individually rather than selling one uniform identity product.
What remains unverifiedAuthenticity, consent, same-person consistency, quantity and verification success were not established.
Identity2026-08-08
Same-person document and selfie packages
Price not statedA minimum of five pairs is stated. The menu claims matching driving-licence, social-security and selfie material. Business-related document packages and address evidence are also advertised.
What the record showsThe advertisement emphasizes matching components and a minimum order rather than a stated monetary price.
What remains unverifiedSame-person identity, authenticity and ability to pass verification remain advertiser claims.
Accounts2026-07-24
Account-rental recruitment for a betting operation
TRY 15,000 promised per accountTravel, meals and accommodation are advertised as covered. No rental duration is stated.
What the record showsA Turkish-language post offers a payment per rented account and covers participant expenses.
What remains unverifiedThe payment is a recruitment promise; duration, actual payment and account use were not verified.
Accounts2026-02-23
Repeated cash-out recruitment form
TRY 70,000 promised per dayThe post recruits people for in-person cash withdrawals. It states that four or five bank relationships are sufficient. This is one dated representative of the separately measured repeated text pattern.
What the record showsA Turkish-language recruitment form combines in-person account access with a fixed daily-payment promise.
What remains unverifiedThe amount is advertised earnings, not observed payment, account value, price, fraud loss or campaign revenue.
Accounts2026-02-02
Bank-access listing with price and claimed balance
$95 asking price; $7,871 claimed balanceLogin information and email access are advertised. The asking price and claimed balance appear on separate labelled lines.
What the record showsAn access advertisement explicitly distinguishes a small sale price from a much larger claimed account balance.
What remains unverifiedThe balance, access and funds were not verified; the two amounts must never enter the same price series.
These are selected examples, not a ranking of providers. “$” stays unspecified where the source did not identify the currency.
Open the full evidence catalogue ↗05For defenders
Three Assumptions Worth Reconsidering.
These are implications of the advertised arrangements, not measured control results. Each points to a different question for the team responsible for that risk.
-
A legitimate login does not settle the purpose.
Recruitment ads ask for a person’s bank relationships and in-person participation. A review centred only on stolen access leaves that advertised scenario outside its frame.
Read the account-participation finding → -
A shared product is not a shared operator.
Hosted panels advertise reusable templates and support. Similar tooling can therefore be consistent with a common supplier; it cannot establish who controlled an observed incident.
Examine the advertised division of work → -
The relationship between files is also for sale.
A document menu sells separate pieces. Another offer claims the documents and selfies belong to the same person. Their presence and their connection are different things to establish.
Read the identity-package finding →
Module
Phishing Monitoring & Domain Abuse
Find look-alike domains and fake pages that copy your brand, and get them taken down.
See how it works →
Free exposure check
Request a demo
Check Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
06 / From research to monitoring
From Research To Monitoring.
07Method & limits
Every Unit Has A Meaning.
- Source
- Brandefense Blackhole.
- Period
- 1 January–27 October 2026 source-post query window. October is partial.
- Edition
- Research edition 1.0.
Distinct post IDs in the retrieved sample and records surviving the historical initial filters. Those filters still contain noise. Neither count is a count of victims, confirmed fraud cases or verified offers. The reviewed catalogue is a separate, selected set.
08Get the research
The Research. Ready To Inspect.
Read the story, inspect the catalogue and reuse the original aggregate charts with their source and limitations.
HTMLEdition 1.0 Research reportAccessible reading edition · full-year PDF in early 2027 HTML5.9 KB Charts & press kitOriginal chart files and attribution HTML4.8 KB Data & definitionsDownloadable records, units and limits
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
09 / All chapters
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
01 · Ransomware 64.7% of claims came from just 33 of 177 groups 03 · Data Breach & Leaks 63% of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts 04 · Stolen Accounts & Combolists 6.3% of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate) 05 · Infostealers 97.5% of January-April raw "stealer" keyword posts carried one brand's notification template 06 · Initial Access Offers 38.2% → 4.9% Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026 07 · Exploits, Tooling & AI 37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims 08 · Hacktivism & DDoS 578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries All eight chapters Open the Cybercrime Report 2026 Eight chapters. Eight units.