Inside the Fraud Underground: Key Takeaways for Retail and Financial Services Teams

The fraud underground has evolved into a sophisticated marketplace where stolen credentials, compromised financial accounts, fraud tools, and illicit services are bought and sold at scale. Threat actors increasingly specialize in different stages of the fraud lifecycle, creating an interconnected economy that allows criminals to purchase the resources and expertise needed to carry out attacks.

In Flashpoint’s recent webinar, Inside the Fraud Underground: What Retail and Financial Services Teams Need to Know, we examined the underground activity fueling financial and retail fraud, including account takeover, refund fraud, insider recruitment, and emerging cash-out methods. Drawing on Flashpoint’s primary source intelligence collections, our analysts explored how these schemes operate and how organizations can use underground intelligence to identify potential threats before losses occur.

Missed the live session? You can still catch the full discussion on demand. Watch the webinar or read on for key takeaways.

The Fraud Underground Operates as an Interconnected Economy

Financial fraud often involves multiple actors specializing in different stages of an operation. Stolen credentials, payment card information, and session cookies obtained through infostealers or phishing are distributed through carding shops, Telegram channels, and underground marketplaces. Buyers then use this information to compromise accounts, initiate fraudulent transactions, and move proceeds through receiving accounts or cryptocurrency.

These marketplaces increasingly resemble legitimate e-commerce platforms, allowing buyers to search for stolen cards by issuing bank, purchase compromised accounts with advertised balances, and evaluate sellers through reviews or escrow services. Flashpoint analysts observed more than 10,000 stolen payment cards added to just 10 active carding shops over a single week, illustrating the volume of financial information circulating through these markets.

Because stolen information often passes through several vendors before being used, monitoring underground activity can help security teams identify exposed accounts and emerging fraud methods before financial losses occur.

Stolen Credentials and Account Takeover Tools Fuel Financial Fraud

Infostealer malware remains a major source of compromised financial information, exposing passwords, payment card details, and browser cookies that are packaged into stealer logs and sold. Some vendors extract and validate financial account credentials before advertising them as bank logs. One listing offered access to a bank account allegedly containing $8,000 for $500, along with access to the victim’s email account, potentially enabling the interception of security notifications.

Threat actors also purchase tools to bypass authentication and facilitate unauthorized transfers. One-time password (OTP) bots use spoofed calls to trick victims into disclosing authentication codes, while stolen session cookies can enable account access without a conventional login. Criminals may then transfer funds into receiving accounts, known as drops, which are also sold through underground marketplaces.

Vendors have also advertised deepfake technology designed to bypass Know Your Customer (KYC) verification by manipulating identity images and video feeds. For financial institutions, monitoring unusual session activity, newly registered devices, beneficiary changes, and suspicious transfers can help identify account takeover attempts, while underground intelligence provides context on the tools and services being used.

Refund Fraud Has Become a Commercialized Service

Retail fraud increasingly relies on specialized vendors offering tools, training, and services to exploit return processes. Refund fraud as a service allows customers to pay operators to obtain fraudulent refunds through fabricated shipping information, false return claims, manipulated receipts, or social engineering. Industry estimates place retail return fraud and abuse at approximately $100 billion in 2025, representing roughly 14% of returned merchandise.

Underground vendors advertise refund fraud menus with pricing based on the targeted retailer and method. Some also sell training materials, including one Telegram channel offering a two-tier course with mentorship, private community access, and a regularly updated list of more than 80 retailers. These services make established fraud techniques accessible to less experienced actors.

Insider recruitment adds another dimension to retail fraud. In September 2026, Flashpoint identified 135 insider recruitment posts associated with the retail sector, the largest identifiable industry category that month. Advertisements sought employees capable of approving refunds, issuing gift cards, or accessing customer accounts. Monitoring these discussions can help organizations identify potentially targeted roles and processes, although individual advertisements do not necessarily indicate successful recruitment.

Gift Cards and Compromised Retail Accounts Enable Cash-Out Operations

Gift cards, compromised customer accounts, and buy now, pay later services provide additional opportunities to convert stolen funds or account access into usable value. Criminals may tamper with physical gift cards before purchase and drain their balances after activation, while stolen or fraudulently obtained cards are sold through underground channels at discounted prices.

Flashpoint observed two vendors advertising gift card purchasing services using the same template 213 times over 60 days, covering approximately 40 brands and card products. Compromised retail accounts with established purchasing histories are also valuable, particularly when they provide access to stored payment methods or credit. These accounts may attract less scrutiny because their activity resembles that of legitimate customers.

Threat actors also use automated checker bots to validate stolen payment cards before making purchases or adding them to digital wallets. Repeated low-value authorization attempts, unexpected wallet registrations, and unusual activity on established accounts can indicate potential fraud.

Underground Intelligence Reveals Fraud Methods Before They Are Used

Monitoring underground marketplaces and criminal communities can expose emerging fraud methods, targeted organizations, and connections between vendors. In one investigation, Flashpoint analysts examined a Telegram channel advertising bank logs and cash-out methods, including instructions for obtaining compromised accounts and transferring funds into aged receiving accounts. A shop promoted within the channel was subsequently traced to nearly 100 additional channels, revealing a broader distribution network.

A separate investigation focused on fake tracking identification (FTID), a refund fraud technique. A search within Flashpoint Ignite returned more than 7,000 FTID-related results over 30 days. Further analysis identified a refund fraud operation promoting multiple methods across three Telegram channels, providing visibility into targeted retailers, fraud techniques, and distribution channels.

These findings can inform fraud detection rules, employee training, and investigative priorities. Because vendors frequently maintain backup accounts and alternative channels, tracking actors across platforms is also important for maintaining visibility when individual communities are disrupted.

Holiday Shopping Creates Additional Opportunities for Fraud

Higher transaction volumes, increased returns, and temporary staffing can create opportunities for fraud during the holiday shopping season. Flashpoint observed underground discussions referencing Black Friday and related fraud terminology rise from 98 posts in October 2025 to 674 in November, an increase of nearly sevenfold. One threat actor specifically discussed conducting fake tracking refund fraud during Black Friday, anticipating that retailers would be overwhelmed by return requests.

These seasonal pressures can amplify existing schemes, particularly refund fraud, account takeover, and social engineering. Retailers can reduce exposure by monitoring underground discussions involving their brands, training frontline employees on common fraud methods, and establishing clear reporting procedures. Financial institutions can similarly track references to their organizations, payment card BINs, and routing numbers to identify potential compromises and inform fraud detection workflows.

Watch the Full Webinar: Inside the Fraud Underground

Underground intelligence provides visibility into the tools, services, and criminal networks supporting financial and retail fraud. Monitoring these activities can help organizations identify compromised information, investigate emerging methods, and strengthen controls before fraudulent transactions occur.

Watch Flashpoint’s on-demand webinar, Inside the Fraud Underground: What Retail and Financial Services Teams Need to Know, for a closer look at the fraud schemes and underground marketplaces affecting both industries.