Dark web identity trading in cheap ‘full identity packs’ undermine biometric security

New analysis from AMLTRIX shows booming trade in stolen and fabricated identities on the dark web, which the anti‑money‑laundering firm believes is exposing weaknesses in biometric verification systems.

Researchers examined 25 widely accessible dark web markets and forums and found that the cost of assembling a package capable of defeating standard KYC checks has fallen to as low as $30. What once required specialist skill has become a cheap, industrialized service.

For the price of a takeout, criminals can now buy a high‑resolution ID scan along with a matching selfie and package of personal data designed to override first‑line checks at banks, fintechs and cryptocurrency platforms. Systems that need live video verification are now being spoofed using ever more advanced camera‑emulation tools.

Gabrielius Erikas Bilkštys, co‑founder of AMLTRIX, said the illicit market has become both abundant and automated. “A full identity pack with ID scan and selfie is now cheap enough and accessible for criminals to buy in bulk,” he said.

Once an identity enters the underground economy, it can be reused repeatedly to open bank accounts, payment profiles or crypto wallets, and victims unaware until debt collectors or law enforcement get in touch.

Unlike stolen card details, which quickly lose value, a “Full Identity Package” can underpin mule accounts capable of laundering significant sums before detection. Prices vary by jurisdiction. U.S. profiles typically sell for $45–$100, UK identities for $30–$35, and Australian, Russian or French profiles for $20–$30. High‑priced listings for ID such as Irish or UK passports, which can exceed $2,500, are often scams targeting other criminals.

A striking shift is the rising premium on pre‑verified accounts. Verified crypto accounts now sell for $200–$400, almost ten times costlier than raw identity data. The markup is indicative of the high failure rate among criminals attempting to bypass biometric verification themselves, according to AMLTRIX. In effect, criminals are forking out a $270 risk premium to outsource the difficulty of defeating live verification systems.

Bilkštys cautioned that the dark‑web economy is not an isolated ecosystem but one fuelled by the same phishing attacks, data breaches and account takeovers that financial institutions face. He argues that simply collecting more documents or selfies is no longer enough.

As identity fraud becomes cheaper, faster and more automated, he said, the challenge for banks and fintechs in 2025 is shifting. The task is determining whether the person behind the device is a genuine individual or a product of the dark web’s “bargain‑basement identity factories.”

The AMLTRIX Framework — an open-source, community-driven resource for mapping financial crime operations — features a growingly comprehensive list of techniques and methods used by these bad actors.

Article Topics

AI fraud  |  AML  |  AMLTRIX  |  biometrics  |  fraud prevention  |  identity document  |  identity verification  |  KYC  |  selfie biometrics