Table of Contents
Introduction: From Lone Fraudsters to Industrial Fraud Services
In October 2025, Europol dismantled a criminal network operating a SIM-card rental service across roughly 80 countries. The operation enabled phishing, smishing, and identity concealment at an industrial scale, linked to over 49 million fake accounts and thousands of fraud incidents across Europe. The criminals did not build everything themselves. They purchased tools, rented infrastructure, and outsourced specialities to other criminals in a supply chain that mirrored a legitimate business.
This is fraud as a service in practice. Criminals can now outsource parts of their operations to specialists in the FaaS ecosystem-renting phishing kits, buying stolen data, and commissioning mule networks on demand. The result is a modular, scalable fraud supply chain where minimal technical expertise is needed to commit fraud at volume.
For financial institutions, the implications are direct. FaaS-enabled schemes industrialize account takeover, synthetic identity fraud, and social engineering scams, and the proceeds flow through regulated channels. Detecting this requires linking fraud detection, transaction monitoring, entity intelligence, and AML into a connected system-a perspective increasingly described as FRAML.
This article is written for senior risk, fraud, and AML professionals at banks, fintechs, and payments firms.
What Is Fraud-as-a-Service (FaaS)?
Fraud-as-a-Service is a criminal business model in which actors sell or rent fraud services, fraud tools, data, infrastructure, access, and expertise-often via the dark web and encrypted messaging platforms-to other criminals, enabling large-scale fraud with little technical skill. FaaS sells tools for online payment fraud, identity theft, credential stuffing attacks, and more.
FaaS is not simply “online fraud.” It is an ecosystem where specialized FaaS providers operate distinct services:
Phishing kits and phishing-as-a-service portals-criminals use phishing kits to create fake websites and emails for data theft, and these kits are a substantial part of the FaaS market
Fake identity packages, synthetic identity kits, and KYC document forgeries
Account takeover bots, credential stuffing tools, and access management bypass utilities
Botnets, remote access tools, and hacking services
Mule-account recruitment networks and refund fraud scripts
DDoS attacks and distributed denial of service tools, sometimes bundled alongside fraud offerings or used for extortion and demanding ransom payments
FaaS mirrors legitimate Software-as-a-Service businesses by offering subscription models, tiered pricing, customer support, tutorials, and even satisfaction guarantees. FaaS operations often feature customer support and educational materials for users-step-by-step playbooks that allow non-technical individuals to commit fraud easily. Europol’s IOCTA 2025 report confirms that crime-as-a-service platforms now supply stolen credentials, data, and fraud tutorials at scale. FaaS is projected to grow alongside the SaaS market as criminal ecosystems continue to professionalize.
How Does Fraud-as-a-Service Work? The FaaS Risk Chain
Understanding how fraud-as-a-service works requires seeing it as a chain where each step can be provided by different fraud services. The FaaS Risk Chain follows six stages: Acquire → Enable → Execute → Monetize → Move → Launder.
Acquire: FaaS operators harvest stolen credentials, device fingerprints, session cookies, and customer data from breaches, infostealer malware, and underground marketplaces. Over 23 million records of stolen credit card data were sold on dark web forums in 2022 alone. Stolen credit card information, leaked KYC documents, and credential dumps feed the raw material supply. Underground forums and encrypted platforms serve as distribution channels, allowing criminals to maintain anonymity while trading user identities.
Enable: FaaS providers sell the necessary tools and infrastructure-phishing-as-a-service portals, credential stuffing bots, automated scripts for vishing and smishing campaigns, loan-stacking kits, and access management bypass tools. These illicit services lower technical barriers for committing fraud by providing pre-packaged tools and playbooks.
Execute: Buyers launch sophisticated attacks: large scale attacks involving account takeover, new-account fraud using fake identities, authorized push payment fraud, or refund fraud using rented scripts. Phishing attacks remain a primary execution method, alongside social engineering and credential stuffing attacks.
Monetize: Stolen funds are extracted by draining bank accounts, abusing credit lines or BNPL facilities, creating fraudulent merchant accounts, making unauthorized purchases, or claiming false refunds and chargebacks. Ecommerce fraud cost organizations $41.4 billion in 2022, according to Juniper Research.
Move: Proceeds flow into mule accounts, prepaid cards, high-velocity P2P payments, e-wallets, and crypto on/off ramps. Transferring money rapidly across jurisdictions makes interception difficult. FaaS provides tools for money laundering and cash-out services for illicit funds.
Launder: Proceeds are layered and integrated via shell companies, trade-based schemes, high-risk merchants, gambling platforms, or crypto mixing-often only detected through real-time transaction monitoring or beneficial-owner screening.
Each stage can be owned by a different actor. The fraud methods at one stage feed directly into the next, creating a growing trend toward fully industrialized fraudulent activities.
Why Is Fraud-as-a-Service Becoming a Bigger Financial Crime Risk?
FaaS transforms fraud from a skill-constrained activity into a highly scalable business model. FATF’s 2026 report identifies fraud as a major money laundering risk across 90% of assessed jurisdictions. A 2023 industry survey found that 56% of fraud analysts reported encountering FaaS schemes, confirming how deeply this model has penetrated the financial crime landscape. Organizations face direct financial losses and reputational damage from fraud-and average losses continue to climb.
Several structural drivers are accelerating this risk:
Lower barriers to entry: FaaS lowers the barrier to entry for cybercrime significantly. Non-technical actors can purchase full fraud playbooks-phishing kits, fake identities, call scripts, OTP-bypass tools-with support in multiple languages, enabling novice fraudsters to execute sophisticated fraud schemes without technical skills.
Criminal specialization: Distinct actors develop malware, run bulletproof hosting, recruit mules, or forge KYC documents. The FaaS ecosystem resembles a legitimate supply chain. FaaS enables criminals to scale attacks by purchasing capabilities from specialists rather than building them.
Explosion of data: Large data breaches and credential dumps provide raw material. Experian reported identity fraud cases rose approximately 60% in 2024 versus 2023, with synthetic identity fraud representing 29% of cases. FinCEN’s analysis showed roughly 42% of BSA suspicious activity reports involving identity exploitation, representing approximately $212 billion in suspicious activity in 2021. Over 23 million stolen credit card records were available in 2022, feeding identity farms and account fraud.
Automation and scale: Botnets and automated scripts allow millions of login attempts, card tests, or refund requests far beyond manual fraud methods. TransUnion data shows synthetic identity fraud volume rose 184% from 2019 to 2023.
Digital payments and cross-border rails: Instant payments, open banking APIs, and cross-border fintech rails give FaaS operators faster, harder-to-reverse routes. These emerging threats compound the difficulty of intercepting stolen funds in transit.
Regulatory pressure: Regulators increasingly expect institutions to demonstrate effectiveness against cyber-enabled fraud. Failure to address FaaS-driven financial crime in risk assessments creates supervisory exposure. In the UK, fraud now accounts for over 40% of all crime.
FaaS platforms and FaaS providers continue to expand. The service FaaS model, operating through underground marketplaces and encrypted platforms, shows no sign of contracting. Investing in advanced fraud detection tools is essential for banks facing this environment.
How AI Is Changing Fraud-as-a-Service
Artificial intelligence and machine learning are amplifying specific parts of the FaaS ecosystem. AI and automation are increasingly integrated into fraud tools to enhance attacks-but AI is an amplifier, not an omnipotent threat.
Synthetic and fake identities: AI helps generate realistic synthetic identities, forged documents, and deepfake face or voice samples that can bypass basic KYC and remote onboarding checks. This is directly relevant for financial institutions and crypto platforms conducting digital onboarding.
Hyper-personalized social engineering: Large language models craft tailored phishing messages and scam scripts in real time, increasing success rates of business email compromise and authorized push payment scams. Europol’s IOCTA 2025 notes higher tailoring of scam content to victims.
Automated fraud campaigns: AI-driven tools iterate card-testing patterns, refine credential stuffing strategies, and adjust mule recruitment-adapting based on which fraud methods succeed against particular issuers. U.S. account takeover losses exceeded $15.6 billion in 2024, with automation a significant contributing factor.
Adaptive fraud tools-as-a-service: Some FaaS platforms update kits in near real time when banks adjust controls-for example, changing device checks or step-up authentication-shortening the defender’s reaction window.
Documented developments already include AI-enhanced phishing and credential exploitation. Near-term risks that AML and fraud leaders should scenario-plan for include real-time deepfake impersonation in live calls and fully autonomous fraud campaigns. FaaS allows sophisticated attacks to gain access to financial systems faster than many institutions can respond, though detection capabilities using anomaly detection and AI-based fraud detection are also advancing.
Why Fraud-as-a-Service Is Also an AML Problem
The chain is explicit: FaaS-enabled fraud generates illicit proceeds, which flow through mule accounts and entities, become layered transactions, and are integrated into the legitimate economy. For financial institutions, exposure extends beyond the initial fraud loss to downstream money laundering and regulatory risk.
Fraud does not end at the victim’s loss. Stolen funds flow into networks of mule accounts, shell entities, high-risk merchants, and crypto exchanges, touching multiple banks and jurisdictions before being cashed out. FaaS operators may exploit stolen credentials to gain unauthorized access to accounts specifically to layer and move proceeds.
Hybrid patterns: The same entity may appear in fraud monitoring as a mule and later in AML systems as part of unusual cash flows. Separate fraud and AML teams often see fragments that only make sense when combined. Ransom payments from cyber attacks, including those facilitated by DDoS attacks, can flow through the same channels.
Intersection with AML typologies: FaaS-driven red flags include rapid fund movement through newly opened accounts, repeated small-value transactions (smurfing), pass-through merchant account activity, and circular flows between related entities.
Data and signal silos: Many institutions keep fraud detection, transaction monitoring, name screening, KYC, and adverse media in separate platforms. This makes it difficult to correlate early fraud signals with later AML alerts. Without connecting fraud and AML data, institutions miss aggregated risk.
Regulatory expectations: FATF now explicitly flags cyber-enabled fraud as a leading money laundering risk. Ignoring FaaS in AML risk assessments and incident response planning is becoming a supervisory concern.
Effective response requires linking fraud indicators-device changes, login anomalies, account takeover attempts-with AML data such as customer risk scores, ownership networks, and cross-border transaction patterns.
How Can Financial Institutions Detect and Disrupt FaaS-Enabled Fraud?
Combating industrialized fraud requires layered, intelligence-driven capabilities across identity, behaviour, transactions, entities, and networks-not just stronger login controls or simple rules. Multi factor authentication should be mandatory for all customers as a baseline, but it alone is insufficient against FaaS-enabled attacks.
Continuous customer and entity intelligence: Maintain dynamic risk profiles combining KYC, device history, behavioural baselines, adverse media, sanctions and watchlists, and known fraud events. Entity intelligence tools should flag when customer data or identities appear in dark web offerings.
Behavioural and AI fraud detection: Advanced analytics and behavioural biometrics identify patterns indicative of account takeover, mule activity, or synthetic identities. Real time monitoring of session behaviour, impossible travel, and device fingerprint changes supports fraud prevention by helping stop suspicious activity before funds move.
Transaction monitoring: Near-real-time transaction monitoring is critical for interrupting FaaS-enabled schemes-rapid movement through mule chains, high-velocity small transfers, or sudden external transfers to unknown accounts require immediate detection.
Network and graph analytics: Mapping relationships between accounts, merchants, devices, IPs, and legal entities exposes mule networks and hub accounts servicing multiple FaaS campaigns.
Cross-channel intelligence: Connecting signals from cards, payments, loans, and digital channels reveals how FaaS campaigns move across products and entities.
Dark web and threat intelligence: Financial institutions must conduct dark web monitoring regularly-watching for their BINs, authentication flows, or customer data being traded on underground forums and FaaS platforms enables pre-emptive defence.
Investigation workflow integration: Integrated case management where fraud and AML investigators can view each other’s alerts, historical cases, and external intelligence is essential for reducing false positives while maintaining sensitivity.
From Fraud Detection to FRAML: An Integrated Fraud and AML Approach
Separate fraud and AML stacks struggle against industrialized, FaaS-enabled crime because they see different slices of the same ecosystem and often use different data, models, and teams. FaaS operates across the full financial crime lifecycle, and detection must do the same.
The FaaS Detection Stack provides a useful framework: Identity → Behaviour → Transaction → Entity → Network → AML. Each layer adds context. Stacking them reveals FaaS-driven financial crime patterns that isolated systems miss.
FRAML-Fraud plus AML as an integrated operating and data model-connects fraud detection, transaction monitoring, entity intelligence, sanctions, and adverse media into a unified approach rather than siloed functions. Benefits for FaaS detection include faster recognition of mule networks, better linkage between attempted account takeover and subsequent suspicious transactions, stronger case files for law enforcement, and more accurate customer risk segmentation.
Practical steps toward FRAML include connecting fraud and AML data lakes, harmonizing identifiers across systems, building shared typology libraries, designing joint detection scenarios, and deploying unified investigation tooling.
ZIGRAM’s FRAML framework supports this approach by integrating name screening (PreScreening.io), transaction monitoring (Transact Comply), entity intelligence (Entity Hero), and fraud monitoring (Fraud Fighter) to help institutions build connected financial crime detection across the full FaaS risk chain.
The important shift is not merely that fraud is becoming more sophisticated. It is that fraud ecosystems are becoming more interconnected-and institutions that continue to operate fraud and AML as separate domains will increasingly find themselves detecting fragments rather than patterns. Moving toward integrated financial crime intelligence is becoming a strategic imperative, not an operational nicety.
Frequently Asked Questions About Fraud-as-a-Service
Senior AML, fraud, and risk leaders often raise similar strategic questions when evaluating FaaS risk and controls. These concise answers are designed for quick reference.
What is Fraud-as-a-Service?
Fraud-as-a-Service is a criminal business model where fraud tools, stolen data, infrastructure, and expertise are sold or rented-often via the dark web and encrypted apps-so that buyers can run large-scale fraud schemes without building their own capabilities. FaaS lowers the barrier for cybercrime by providing pre-packaged fraud tools, phishing kits, and identity packages to anyone willing to pay.
How does Fraud-as-a-Service work?
FaaS follows a chain: criminals acquire data or credentials, then purchase or rent enabling tools (phishing kits, bots, fake identity packages), execute fraud (account takeover, new-account fraud, refund abuse), monetize through stolen funds or credit abuse, move proceeds through mule accounts and payment rails, and launder through layering and integration. Different actors in the ecosystem may own different steps, and the proceeds ultimately pass through regulated financial institutions.
Why is Fraud-as-a-Service a financial crime risk for banks and fintechs?
FaaS increases the volume and sophistication of fraud attacks-account takeover, synthetic identity fraud, refund abuse, and online payment fraud are all more frequent and harder to detect. The resulting proceeds, mule activity, and shell-entity flows create AML, sanctions, and regulatory risks beyond direct financial losses. Ecommerce fraud alone cost organizations $41.4 billion in 2022, illustrating the scale.
How can financial institutions detect Fraud-as-a-Service activity?
Institutions should combine behavioural analytics, AI-enabled fraud detection, real-time transaction monitoring, entity and network intelligence, dark web monitoring, and closer integration of fraud and AML signals. Graph analytics help identify mule networks and hub accounts. Multi factor authentication, device intelligence, and anomaly detection provide additional defensive layers to spot FaaS patterns earlier.
Is Fraud-as-a-Service related to money laundering?
Yes. FaaS generates large volumes of illicit proceeds that must be moved, layered, and integrated via accounts, entities, and payment channels. Mule accounts, shell companies, high-risk merchants, and crypto mixing are integral to many FaaS campaigns, making it a direct AML concern. Institutions that fail to connect fraud signals with AML monitoring risk regulatory exposure and undetected laundering.
