The everyday internet presents a variety of risks for businesses and consumers. Identity theft and unauthorized purchases incite the greatest concern, but they aren’t the only, or even the most expensive, types of fraud that impact online commerce. And while the dark web consists of websites that can’t be accessed via normal browsers, it remains a popular source of fraud fears. Getting in requires a direct URL and an anonymizing web browser (e.g., the Tor Browser), and many users add a virtual private network (VPN) on top. To do real damage to businesses, its residents have to come up to the internet’s surface and attack.
The deep web, on the other hand, is massive. It makes up most of the internet and refers to any sites that are not indexed by search engines. Anyone with the right links can find them, and quickly commit fraud through the sites that enable them to do so.
Dark web operators regularly use unprotected deep web pages to advertise their services, test stolen information, prove vulnerabilities, and recruit new fraudsters into the fold. That reach adds to the threat from fraudsters attacking businesses and consumers directly during online transactions and transfers.
The dark web fuels the global Fraud Economy
The dark web is tiny compared to the deep web, and nearly impossible to stumble across by accident. A user ends up there on purpose, using specialized software that routes traffic through multiple layers of connections to keep their actions hidden.
Those actions can include purchasing pre-verified lists of hacked credentials or credit card numbers; syncing up with fellow fraudsters to commit large-scale attacks; or buying digital tools that can be used to mine servers and user accounts for resellable data. Some dark web merchants even offer malware-infested templates that can be used to create fake online storefronts used for capturing buyer data. Group-IB estimates that infostealer logs, combolists, and similar credential files generate between $10 billion and $20 billion a year for the cybercrime economy.
These activities, and the people participating in them, power the Fraud Economy, the worldwide network of abuse vectors and cybercriminals that brings risk to e-commerce every day through payment fraud, account takeovers, spam, scams, chargeback fraud, first-party fraud, and multiple other types of digital abuse. The combined force of attacks that are increasingly automated, sophisticated, and scalable forced businesses to get smarter, faster, and more agile with trust and safety.
In response, fraudsters adopted e-commerce best practices and flipped them, turning stolen data and proven attack methods into profitable, marketable fraud inventory that’s promoted, purchased, and deployed on the broader deep web, with costly repercussions for legitimate businesses and consumers.
The data from the Sift Global Data Network shows how that inventory gets used. In one Food & Delivery card-testing ring, a single email address cycled through 94 distinct cards across 390 transactions at five businesses. The average order was $4.06, low enough to slip under many detection thresholds. In a loyalty fraud ring, taken-over and newly created accounts produced nearly 13,000 attempted transactions across more than 90 businesses. Each merchant saw only one piece of the pattern, and users tied to fraudulent chargebacks had 15.8x higher Mean Global Linkage than users without chargebacks.
The deep web is where fraudsters go phishing
The deep web includes hidden or de-indexed parts of the internet that aren’t accessible via traditional search engines. Making up the vast majority of the internet, the deep web includes email, databases, archives, password-protected sites, and private intranets, and most of them are perfectly safe, operating legally, and hard to find for the sake of security alone.
Fraud is now more prevalent and accessible thanks to the deep web. As it gets easier for anyone with internet access to buy and sell stolen payment information, we’re seeing fraud become more democratized and rampant. Similar to how software providers work to give more users in a business access to the platform, fraudsters have made their methods easy to find and easy to use for anyone with internet access. Sift’s Q2 2026 Digital Trust Index shows the effect: 26% of U.S. consumers experienced online payment fraud in the past year, and 22% experienced account takeover.
Cybercriminals are monetizing this opportunity by turning their fraud skills into commodities for sale, making it easier for amateur fraudsters to cash in. The deep web now features a growing number of tools and services that individuals can purchase in order to steal from businesses and consumers. This trend, known as fraud-as-a-service (FaaS), is a spectrum of how-to fraud tools, technology, and tactics that are packaged up for sale to other fraudsters, positioned to trick consumers, or used to lure in criminal recruits. The catalog includes phishing kits, anti-detect browsers, and malware loaders; stolen credentials, payment cards, and identity document sets; and mule accounts, cash-out routes, and even ticket-based customer service. INTERPOL estimates that global fraud losses reached $442 billion in 2025 and names FaaS platforms as a primary driver of fraud’s industrialization.
Typically found on easily accessible deep web forums like Telegram, these schemes operate similarly to online marketplaces. Group-IB lists Telegram channels alongside dark web markets as a main place where these tools and stolen data change hands. Seasoned fraudsters sell on-demand services to other, sometimes first-time, culprits: a new wave of fraudsters determined to siphon funds and data from vulnerable merchants and their customers.
Stolen logins are only the first step. Global account takeover (ATO) block rates fell 28% from Q1 2025 to Q1 2026, but Internet & Software was the only tracked vertical to worsen, rising 6%. The Q2 report also cites an estimate that more than 65% of breached accounts had multi-factor authentication (MFA) enabled when they were compromised, so login controls alone can’t carry the load.
Most of what’s associated with the deep and dark web has to do with underground marketplaces, forums, and the unsavory exchanges that take place on them. The deep web also provides online spaces where internet users can take full advantage of their rights to privacy and data protection.
What fraud teams can do
You can’t monitor every corner of the dark web, but you can shrink the window between a leaked credential and a fraudster using it.
- Check for exposed credentials. Compare customer logins against known breach data, and prompt resets on a match.
- Look at signals together. Identity, device, payment, and behavior data tell a clearer story combined than in separate queues.
- Tune by payment method. Payment fraud attack rates ranged from 9.46% for cryptocurrency and 8.36% for electronic fund transfers to 4.48% for cards.
- Match friction to risk. Step up verification when signals are mixed, and block when confidence is high. The average false positive cost $135 across the network in Q1 2026.
Watch A Dive into the Dark Web with Sift and The Dark Web, Account Takeovers, and You for more on this topic, or read the Q2 2026 Digital Trust Index for current benchmarks.
