Fraud Schemes

Fraud Schemes Exposed

Explore the latest scams and fraud tactics uncovered by Sift’s Trust and Safety Architects.

The Global Fraud Economy

Fraudsters have evolved from siloed attacks to a full-blown Fraud Economy—a sophisticated and interconnected network of cybercriminals looking to exploit online businesses.

ATO-as-a-service

Fraudsters Use Automation to Accelerate Attacks

Atlantis AIO (also known as Atlantis-X) is a fraud-as-a-service credential stuffing tool, accessible via a simple link for $150 per month.

Step 1
A fraudster finds and clicks the Atlantis AIO link and pays the $150 monthly subscription fee. It’s common for users to sign up using cryptocurrency, adding a layer of anonymity to the transaction.
Step 2
Behind the paywall, the fraudster enters the stolen or purchased account credentials into the Atlantis tool, which uses automation to rapidly verify if, and where, those credentials are accurate and active.
Step 3
Login details can be entered individually or in bulk. Once credentials are either authenticated or proven defunct, the fraudster can plan the next phase of attack.
Step 4
The fraudster takes the Atlantis-authenticated data to the related website or app, quickly and easily accessing the compromised account and any funds or additional identification details protected behind it.

Bots-as-a-service

Mechanics of an Automated Scam

Step 1
The fraudster joins a bot-as-a-service scam group on a deep web forum and pays for temporary use of the OTP bot.
Step 2
The fraudster enters the victim’s phone number into the OTP bot.
Step 3
The fraudster provides the bot with the caller ID for the site or app they want to spoof.
Step 4
The bot calls or texts the victim, impersonates the business, and asks them to provide their OTP.
Step 5
The fraudster receives the OTP to successfully log into the victim’s account.
Step 6
The fraudster can now access and steal the victim’s payment information to make unauthorized purchases.

Fraud-as-a-service

Mechanics of a Criminal Business Model

Step 1
The fraudster steals e-gift card credentials via hacking, malware, or phishing.
Step 2
The fraudster creates or joins a group on a deep web forum and cultivates a following.
Step 3
The fraudster advertises the e-gift cards to other fraudulent buyers at a deep discount.
Step 4
An opportunistic buyer agrees to purchase multiple e-gift cards at 50% off.
Step 5
The fraudster earns a profit and the buyer makes purchases with the stolen e-gift cards.

Fraud attacks in one industry impact every industry.

The Fraud Economy is an interconnected web of fraud and abuse vectors that influence and impact one another. Explore data insights from the Sift global network of more than one trillion eventsper year, representing over 34,000 sites and apps across multiple industries, and learn how cybercriminals leverage the Fraud Economy to target businesses and consumers around the globe.

Crypto Cashout: When Fraudsters Join Forces

Click through the timeline to see how the scam works.

Step 1
Fraudster A has access to stolen or illicitly-obtained funds.
Step 2
Fraudster B takes over bank, crypto wallet, and crypto exchange accounts.
Step 3
Fraudster A solicits on Telegram for combined bank and crypto account access. Fraudster B responds with offer to work together.
Step 4
Fraudster A loads the stolen funds into Fraudster B's bank account. Fraudster B transfers the funds into stolen crypto exchange account or wallet.
Step 5
Fraudster B withdraws the funds from the crypto wallet to an offline wallet. Fraudsters split the profits.