The Work Behind The Fraud Offer.
Card material, phishing methods, account participation and identity packages: compare what selected advertisements promise and what their wording actually supports.
- 33.9%
- 831 of 2,448 retained financial-account postscarry one narrow cash-withdrawal recruitment pitch, under 132 source names. The unit is posts, not people or sellers.
- One ad
- Two claimsA May phishing ad promised to bypass every form of two-factor authentication, then said it would wait for the user’s approval or SMS code. The unit is one dated advertisement, not a success rate.
- 11,540
- Distinct retained records36 core catalogue records and separate card and phishing-method supplements. Observation window: 1 January-27 October 2026.
Brandefense / Cybercrime Report 2026 / Fraud Inside the Fraud Service Economy 1 January-27 October 2026. Dataset v1.0. Observed records, not a market total. Get The Fraud Report.
Read the story, inspect the catalogue and reuse the original aggregate charts with their source and limitations.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Six Questions. Who Does The Work?
These findings concern advertised arrangements in saved Brandefense Blackhole records. No service was purchased or tested. The collection does not establish actual participants, completed fraud, loss, or a market-wide shift.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text, numbers and charts as a web page, with headings, chart descriptions and tables that screen readers can follow.
- 01 Stolen Card Ads Sell Different Promises of Usability How card-data ads qualify refunds, replacement and expiry. Read online →
- 02 Phishing Offers Target More Than a Password What phishing offers seek beyond a password. Read online →
- 03 The Human Work Behind Account-Rental Ads Why an account-rental offer covers participant expenses. Read online →
- 04 Phishing Service Ads: Who Does the Technical Work? Which technical work hosted providers promise to take on. Read online →
- 05 What Identity Fraud Bundles Claim About a Person How identity packages market a relationship between documents. Read online →
- 06 831 Different Texts, One Cash-Withdrawal Pitch What repeated recruitment messages reveal about the saved sample. Read online →
Inspect The Evidence Behind The Story.
An ad does not prove a sale or show that a tool works. Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01The observed unit remains the source record and its stated claim. No population extrapolation, weighted market total, confidence interval or price index is published.
- 02Sampling: larger windows used sampled pages. Unequal sample allocation prevents a market-composition reading.
- 03Taxonomy and filters: broad selection can retain noise and mixed intent. Class labels changed around May-July; October is partial.
- 04Attribution: shared wording and source-name strings do not establish people, providers, coordination or a campaign.
- 05Outcomes: no purchase, delivery, effective tool, completed sale, realized loss or prevention result was verified.
- 06The saved collection is dominated by Telegram with limited forum coverage; it does not represent Tor marketplaces, closed communities or the wider underground.
From Research To Monitoring.
Find look-alike domains and fake pages that copy your brand, and get them taken down.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.