On 2 November 2026 one Telegram listing offered identity documents for sale on the dark web in bulk, picked up by Brandefense Blackhole. The advert lists passports, ID cards and driver’s licences from 14 countries and closes with “selling the entire lot”. This post sets what the advert claims beside our reading of what such lots usually are.
It then compares two routes to fraud. One is documents offered in bulk, which we read as stolen. The other is paid recruitment of real people to pass identity checks. The second part is advice for KYC teams at banks, fintechs and exchanges, and it is labelled as ours.
Identity Documents for Sale on the Dark Web: What the Listing Claims and How We Read It
This is one post, seen once, in Brandefense Blackhole on Telegram, created at 11:30 UTC on 2 November 2026. We found it by searching for the document types it names. Everything in the left column below is the listing’s own text; the right column is our reading and cannot be proven from an advert.
| Point | What the listing says | Our reading (not proven) |
|---|---|---|
| Size | The listing gives 18 separate counts, from 1,500 Canadian ID cards and 1,500 USA sets up to 14,000 “US driver’s licenses, SSNs, and LLC documents”. Two lines, 1,000 and 5,800, are marked “[unspecified/placeholder]” | When we add the counts we get 94,100, but this is our sum of the listing’s own lines. Lines may overlap (one carries two items), and the listing gives no total |
| Countries | 14 named: US, Japan, Italy, Spain, UK, Australia, Germany, Colombia, Cambodia, Netherlands, Poland, Philippines, Romania, Canada | A spread this wide across regions can come from several sources. Lots like this are often assembled, not taken from one breach |
| Freshness | “all brand new, none expired” | Freshness is the seller’s wording. The post text we saw carries no sample or file |
| Format | Does not say whether the lot is scans, photos, templates or data fields | Three possibilities: scans of real documents, forged templates, or stolen records. An advert cannot tell them apart |
| Sale terms | “selling the entire lot” as one deal | Selling in one block points to a reseller moving stock, not a buyer picking items |
Brandefense Blackhole’s classifier tagged the post as a PII data leak. That tag is an automated label of the advert, not evidence about the files. We do not publish the seller, the channel, a contact or the price.
Two Fraud Routes That Look Alike to a KYC Team
In the same days Blackhole posts show what looks like a second market that needs no stolen documents. Buyers advertise that they will pay for someone to pass an identity check themselves, often through a link the buyer controls. We read the 100 newest of 1,043 Blackhole posts matching “KYC”, all dated 3 November 2026, and six matches for “passport only” from 1 and 2 November.
In the 100 KYC posts, 29 open with “WTB” or “WTS”, the usual buy and sell shorthand. About a dozen mention verification by link (the exact count depends on how the phrase is matched), for example “kyc via link”. All six “passport only” posts are buy or rate posts, five of them naming a rate, price or payment. The posts name exchanges, payment apps and other online services; we do not name them.
| Point | Stolen documents sold in bulk (our reading) | KYC by link, holder recruitment (our reading) |
|---|---|---|
| What is sold | Copies or records of someone’s documents, in bulk | A real person’s time and face, paid per completed check |
| Who passes the check | The buyer, with another person’s papers | A real holder, who is live on camera and under their own name |
| What a check sees | A document that may be altered, reused or mismatched with the selfie | A genuine document and a genuine face, used for an account the holder will not control |
| Where it shows | Document forensics, reused images, mismatched liveness | Many accounts from one device, network or link pattern; holder and account behaviour that differ |
| Who is harmed | The person whose papers were taken | The platform, and the holder who may be liable for the account |
The point of the comparison is that route two defeats checks that route one fails. A document check passes a real passport held by a real person. This is our analysis of the posts, not a finding that any named service was abused.
What KYC Teams Can Do
This section is our advice, not a finding from the sources. A bulk lot and a recruited holder both aim at the account opening step, so the controls should look at the session as well as the document.
- Check the session, not only the paperScore device, network and the origin of the verification link, and flag many accounts opened from one session pattern.
- Compare liveness with the documentRun an active liveness check and test that the face, the document and the account holder match over time.
- Watch what happens after approvalTrack first transfers, new withdrawal addresses and fast cashout from new accounts, because recruited holders hand over control after the check.
- Treat reused images as a signalCompare document images across applications to find the same template or scan used again.
- Feed in outside intelligenceAdd dark web monitoring for your own brand and document types to your fraud review; see our data exfiltration entry for how stolen data moves.
For the wider chain, in our reading, stolen credentials from malware often come first; our guide to checking infostealer logs and the stealer logs entry explain that step. In our reading, identity documents sit later in the same fraud chain.
What Stays Open
The origin of the lot, the file format, the seller’s stock and any buyer are not stated in the advert. We list no personal data and link to no listing. We recommend treating a single advert as a signal worth watching, not as proof of a breach at any organisation.