Shadow World of Fraud-as-a-Service
Trust & Safety | Fraud & AML Field Notes
On a quiet Sunday afternoon, while most of the country switches off, a different economy switches on. Teenagers from small towns livestream tutorials on defeating banking apps' security checks. Cash-out specialists demonstrate their techniques in dedicated threads. And somewhere in the mix, someone is renting out an entire ready-to-run fraud operation — for a price, with an uptime guarantee.
The Short Version
Bank accounts drained via UPI or net-banking are rarely the work of a lone hacker — they're the output of a supply chain of specialists who never meet.
Each stage — device prep, malware, data, delivery, cash-out, laundering — is sold and bought independently, like any other B2B service.
2026 monitoring shows the ecosystem expanding into regional rural banks, fake merchant accounts, AI deepfakes, and USDT-based laundering.
The single choke point worth defending: making it hard to fake that a compromised phone is a clean one.
From Lone Hackers to an Industrialised Market
When a UPI account is silently drained or a net-banking session hijacked, the instinctive assumption is that a single skilled hacker broke in. That assumption rarely holds anymore.
Payment fraud at scale today runs the way a lot of legitimate commerce does — as a supply chain, with different specialists selling different pieces of the job to whoever is willing to pay. No single person or group ever touches the whole operation end to end.
That structure is exactly why this kind of fraud is so hard to stop by going after any one target. There is no head to cut off. There is a market — and like any market, it has vendors, price lists, customer support, and repeat buyers.
The Chain-link by link
It starts with a phone, not a victim. Before any fraud can happen, the device running it has to convince a banking app that it's an ordinary, unmodified handset — not a rooted device running interception tools. So the first product for sale isn't malware at all; it's device preparation. This single service is consistently the most in-demand product in the whole ecosystem, which tells you something: the hard part was never getting SMS-reading malware onto a phone. The hard part is getting a phone that a banking app still trusts once that malware is on it.
With a trusted-looking device in hand, the next purchase is the actual capability: software built to read incoming texts, forward them elsewhere, and answer back quietly so nothing looks amiss — sold with version numbers, feature lists, and customer support, like any legitimate SaaS product. Bundled with it: a dashboard to watch which infected phones are online and which OTP just arrived.
None of this works without a target, so the next link is data — leaked personal records bought in bulk, because a phishing message that already knows your vehicle registration or scheme enrolment is far more convincing than a generic one. That data feeds a fake app dressed up as a government service or bank utility, engineered to be installed by someone who already believes it's legitimate.
From there, a human cash-out operator takes over — working the account manually, escalating to PIN resets when needed, typically paid a third to half of whatever gets moved. Everyone upstream is ultimately paid out of the same stolen funds once this operator collects. Finally, the money passes through a laundering layer: rented mule accounts, discounted gift cards, and crypto settlement that's harder to trace than a normal transfer.
How a Victim Actually Experiences This
The chain above is abstract. On the ground, it's fast and disarmingly simple — and the victim usually doesn't know anything is wrong until the bank statement arrives days later.
When the victim contacts their bank insisting they never shared an OTP or clicked anything suspicious, the natural assumption on both sides is that a skilled hacker broke in. In reality, nobody in the chain needed to be a skilled hacker at all — each step was a purchased, disposable service.
What's New : Trends Worth Watching
Recent monitoring of underground channels and fraud-reporting data points to a market that keeps adapting faster than the controls built to catch it. None of the specifics below are operational details — they're the shape of where the ecosystem is moving.
Rural Banks Enter the Crosshairs
Demand is expanding beyond major private and public banks into Regional Rural Banks, likely because of lighter transaction scrutiny, newer low-activity accounts, and lower account-holder awareness of misuse risk.
Corporate Banking Features, Weaponized
Ordinary retail accounts aren't the prize anymore. Demand concentrates on accounts with Merchant QR, bulk-upload, CMS, and maker-checker features — the same tools legitimate businesses use to move money at scale.
Fake Merchants, Real UPI Volume
Mule accounts are increasingly onboarded as merchant accounts using forged business documents, letting stolen funds arrive dressed up as legitimate customer payments via a Merchant QR code.
Deepfakes vs. Liveness Checks
AI-generated "blink videos" built from a single photo are being used to simulate natural facial movement and beat liveness detection during remote KYC and onboarding.
USDT as the Preferred Off-Ramp
Underground exchanges convert fraud proceeds to and from Tether, often pricing funds differently depending on how traceable their origin is — the riskier the money, the better the rate offered.
Why No Single Fix Stops It
The resilience here isn't about sophistication — most individual pieces of this chain are unremarkable. It's specialisation. A device-prep vendor never touches stolen data. A data seller never writes malware. A cash-out operator never builds a tool. Each participant is one narrow, disposable link, easily replaced if caught, and none of them needs to trust or even know the others beyond a single paid transaction. Ban one seller, and a buyer finds another offering the same product within a day.
Every version of this fraud depends on convincing a banking app that a compromised device is a clean one. Every fraud attack origination point would be user compromising their device by installing a malware laden APK