Threat intelligence from the dark web: money laundering as a service

Anti-money laundering (AML) professionals face a formidable foe. While risk and compliance officers work diligently, dark web criminals are surprisingly sophisticated and well-organised. Any fight is best approached by understanding the opponent, and advertisements on the dark web reflect an advanced criminal industry.

In almost cartoonish fashion, the AML profession has a dark twin. Individuals and organised groups are peddling professional services for various methods to move and manage large sums of money covertly. This contra-industry of money laundering as a service (MLaaS) is potentially more complex than traditional finance, though unconstrained by regulations. An examination of MLaaS marketplaces shows that these services are governed by a robust system that lives and dies by customer reviews, pricing and
effectiveness.

As with any business, MLaaS providers have both horizontal and vertically integrated business models, conduct sales discovery and prefer getting down to business. A common refrain in dark web advertisements is, “don’t waste my time.” To save time, MLaaS businesses can be categorised into eight categories.

Eight typologies (% of advertisements analysed)

Researchers analysed 213 money laundering advertisements across multiple dark web marketplaces. Ads were only included as “currently active” if posted within the last 12 months.

1. Bank drops (33.3%)

The largest category by far, these are accounts for cashing out, regardless of the money’s source. Traditional bank accounts, as well as peer-to-peer (P2P) transfer credentials, are either sold or rented for commission. This allows purchasers to move electronic funds to a clean account or obtain physical banknotes, often in local currency elsewhere. Prices for these services varied significantly, from empty bank account credentials for $341 to 53% commission to withdraw from a host-operated account.

2. Bank loaders (27%)

A close second to bank drops, these accounts are rented or sold as layering vehicles for moving money quickly. Both typologies use multiple means to move funds, including P2P, crypto and banknotes, sometimes in local currency. Pricing for these accounts was on par with hosted bank drops at 52% commission.

3. End-to-end (8.9%)

Sophisticated groups advertise full-spectrum money laundering, including creative layering through valuable commodities and integration via real estate, securities and holistic wealth management. Research uncovered bizarre offerings, such as jet fuel, investment for citizenship, aged shell companies and Zimbabwean gold coins. Pricing for these services, presumably at scale, was as low as 22% commission.

4. Cash outs (8.5%)

A simpler version of bank drops, cash-out may include in-person cash for asset exchanges. Often, this is the entry-level offering for new-to-the-industry individuals, though organised groups may run high-volume operations. Some of these schemes include cryptocurrency, offering either cash for crypto or vice-versa. Again, fraud mixes with money laundering, and some offerings are merely scams targeting un-savvy victims. Cheque fraud, an old technique, runs rampant through cash-out accounts. Commercialised cash-out accounts demand 42% commission on average. High rates attract newcomers.

5. Physical goods (3.3%)

Trade goods are a classic and effective way to move value through physical items, such as precious metals, gemstones or jewellery. As end-to-end providers show, value comes in many forms, including petroleum products. To the keen eye, petroleum is useful to sanctioned countries that may have trouble buying or selling such commodities, enhancing black market value.

6. Shell companies (1.9%)

Few advertisements offer this complex service. Gatekeeper professions, such as accountants and lawyers, are important and sometimes necessary. Additionally, all companies come with paperwork, something money launderers hope to avoid. Still, the service is useful and available.

7. Fake statements (7%)

Often sold as editable templates, forged paperwork can support front business operations. This capability, combined with shell companies, is vital to high-value laundering operations. Statements are useful when fraudulently applying for a new bank account, loan or mortgage. Whether for resale, break-out or as a vehicle for laundering, the criminal possibilities are many. This was by far the cheapest service, with two-digit template prices.

8. Insiders (9.4%)

In anti-fraud psychology, experts describe a triangle of thoughts and events that, when complete, generate a risky scenario for fraud. The fraud triangle consists of access, need and rationalisation. For reasons unknown but likely familiar, some employees rationalise using their position and access for financial gain. Internal controls are more important than ever.

Key takeaways

    Fraud and AML have a nexus

    On the dark web, fraudsters and money launderers are working together with no firewall between teams. They share information, tips and even bank accounts. Fraud and AML departments must share knowledge and coordinate to avoid blind spots and work duplication.

    Due diligence at a new level

    Professional money launderers use fake statements from fake companies with fake histories. They abuse legitimate accounts for criminal purposes. The modern era requires true knowledge of customers, partly with high-accuracy digital tools. Some customers may require an old-fashioned, in-person visit. Either way, enhanced due diligence teams cannot be allowed to fall behind because it leads to a self-appreciating problem when controls break down.

    Threat intelligence program

    Understanding the true scope and sophistication of the laundering services offered on the dark web is vital to defend against and preempt broad attacks and money laundering schemes. Briefing investigators to know current schemes helps them be more effective.

    Digital tools

    Advanced digital tools will have an immediate impact on compliance team capabilities and corporate profits. Computer-aided filtering of false alerts and advanced methods of communicating directly with clients can dramatically increase team productivity.

    Stay focused

    A workforce that understands its financial crime opponent will work more diligently and effectively. The industry must be better informed, coordinated and modernised. Stay focused and keep striving.

    This article was originally published on Thompson Reuters Regulatory Intelligence. It is based on the findings of research conducted by Daniel Shkedi, head of product marketing and strategy, Refine Intelligence.