Fraud rampant across several Darknet marketplaces

Darknet marketplaces are seeing growing demand for gift cards and loyalty point accounts that enable users to save money. Offers for discount travel fares and reduced restaurant prices may seem fairly insignificant when juxtaposed with sales of drugs, guns, lethal chemicals, and sensitive credit card data, but interest in the fraudulent listings is growing.

The very fact that there are more dangerous products available on the Darknet is a large part of the appeal. As law enforcement agencies spend ever more time tracking drug and gun vendors, low-level fraud such as gift card and loyalty point account sales are slipping under the radar. Buyers are purchasing unauthorised vouchers and discount deals safe in the knowledge that their low-level crimes are not a priority to law enforcement.

fig1

The screenshot above is taken from the forum area of DreamMarket. The listing shows vendor @xiao_baobei selling a number of discount deals for food, music, shopping, and flights. The thread has been viewed 56,192 times – far and away the highest number of views compared to other recent listings.

Gift cards and accounts for restaurant chains are amongst the most popular of @xiao_baobei's products, including: Dunkin Donuts, Starbucks, Dominos, Sam's Club, Restaurant.com, Delivery.com, Eddie Merlot's, TGI FRiday's, City Barbecue, El Pollo Loco, Freddy's Steakburger, Spaghetti Warehouse, Mellow Mushroom, Uno, Fatz, Cafe, Primanti Bros, Shake Shack, and Bagger Dave's.

The vendor's shop also includes listings for British Airways Avios points and Ticketmaster accounts as well as loyalty cards from Bloomingdales, Walmart, and Groupon.

On TradeRoute forum, there is an entire section dedicated to fraudulent travel deals:

fig2

There is a high level of interest in these listings, with many views and comments being left. Feedback is almost exclusively positive for such listings – while it is not possible to verify that listings are genuine (nor the number of views, nor the positive feedback), the widespread trend across numerous sites suggests that there is growing demand for discounts across the travel, retail, and hospitality sectors.

Tochka Marketplace also has a dedicated section for fraudulent travel deals:

fig3

Although the marketplace offers no indication of views or sales, the travel and hospitality sectors are a clear target.

We also recently reported on refund tutorials being sold on DreamMarket:

fig4

As well as ASOS (pictured), vendor @JustBuyIt offers refund schemes for a wide range of retailers including: Dicks Sporting Goods, Neiman Marcus, Bergdorfgoodman, Macy's, JD Sports, Hollister, Urban Industry, Urban Outfitters, Topman, River Island, H&M, Pacsun, Tillys, and Karmaloop.

After AlphaBay and Hansa marketplaces were taken down by law enforcement, the remaining Darknet marketplaces were thrown into confusion, with vendors and buyers alike both anticipating further infiltration from law enforcement. This sense of uncertainty is persisting, and there has been a distinct drop off in the volume of high-level criminal wares being sold as vendors are fearful that their sales history may be under surveillance. Instead much Darknet traffic is now turning to low-level fraud as vendors and buyers alike capitalise on the small profits that can be made without attracting unwanted attention from authorities.

Though unverifiable, the high numbers of views and comments surrounding these listings indicates strong interest from buyers. We therefore expect companies operating with customer accounts across these sectors to continue being targeted as Darknet vendors seek to match supply with demand.