The account-farm economy Resistant AI mapped runs on a simple asymmetry: sellers monetize a single verified identity for roughly $344, while buyers use that identity to layer thousands of dollars in laundered payments or push-payment fraud through a single institution. That gap between acquisition cost and downstream yield is why Resistant AI counted product listings running into the hundreds of thousands across more than 100 standalone sites and 50-plus Telegram channels — volume economics only work if the unit price stays low and the supply stays deep.
Map the players and the picture sharpens. Sellers split into two tiers: willing money mules reselling their own genuine, KYC-passed accounts, and forgers assembling synthetic identities from breach data, template-farm paperwork and deepfake face-swap tools. Buyers are fraud rings needing bulk accounts to move stolen or laundered funds — the kind of operation that, per Resistant AI, requires thousands of mule accounts to layer authorised push payment fraud. The losers are the more than 3,000 institutions named in the scan: neobanks whose low-friction onboarding is the attack surface, and remittance services whose light receiving-side checks make offloading funds easy. The winners, at least commercially, are the vendors selling detection into this mess.
Resistant AI’s $344 average listing price is small enough to look like noise on a balance sheet — until you remember it’s the wholesale cost of bypassing an entire KYC stack.
That last point deserves scrutiny rather than acceptance. Resistant AI’s numbers come from its own threat-intelligence scan, not an independent audit, and the company sells document-fraud and transaction-monitoring software — the same category MarketsandMarkets projects will nearly double to $80.01bn by 2031, with authentication the fastest-growing segment. Darwinium’s May 2026 SDK update, which linked more than 10,000 mule accounts to shared devices for one Southeast Asian bank, corroborates the scale problem from a different vendor’s vantage point, and Sumsub’s tracking (via tech-insider.org) of multi-step attacks rising from 10% to 28% of identity fraud between 2024 and 2025 fits the same trend. But three vendors converging on the same threat narrative is not independent verification — it’s a market segment agreeing on its own growth story.
What would change the read: disclosure from the 3,000-plus affected institutions themselves, rather than the detection vendor’s telemetry, and a breakdown of how much of that hundreds-of-thousands listing volume is duplicate or dead inventory versus accounts actually monetized. Until then, the account-farm market is best read as a real and growing problem sized, described and priced almost entirely by the companies paid to fight it.
The platform's threat intelligence team found more than 100 standalone sites and more than 50 Telegram channels falsely advertising access to a range of platforms, from mainstream banking apps to crypto exchanges, remittance services and online marketplaces. Product listings ran into the hundreds of thousands, and more than 3k institutions were affected. The average listing price was about $344.
— Sifted
