fraud-as-a-service
Criminal business model in which fraud is sold as a ready-made commercial service
Fraud-as-a-service is a term from international criminological and law enforcement vocabulary for a criminal business model in which fraud is industrialised and offered as a commercial service on criminal markets. Instead of a single perpetrator developing and carrying out an entire fraud operation alone, actors buy or rent access to ready-made tools, stolen databases, technical infrastructure or complete fraud solutions supplied by specialised criminal vendors. The model reflects a division of labour resembling the subscription and service models of legitimate software markets.
A supplier may, for example, make phishing kits, forged identity documents, compromised payment details or botnet infrastructure available, while the buyer uses these resources to carry out specific acts of fraud without possessing the technical knowledge needed to develop them.
In connection with cases such as the Chinese military's hack of Equifax, the concept illustrates how mass theft of personal data does not necessarily end with the original attacker. The stolen data — including social security numbers, addresses and credit information on hundreds of millions of Americans — can subsequently be resold and enter fraud-as-a-service ecosystems, where other criminal actors buy access to the information and use it for identity theft, credit fraud and other forms of deception. In cases involving violent crime, including killings connected to criminal networks such as the murder of the rapper PnB Rock, the term appears in the broader context of organised crime infrastructure, where information about victims — for instance location published via social media — can form part of the criminal information market that supports targeted acts.
Legally, fraud-as-a-service poses a challenge for international prosecutors because responsibility is dispersed across jurisdictions and roles. The supplier, the intermediary and the end user may be located in different countries, and the burden of proof for linking an individual actor to a specific act of fraud typically requires cross-border law enforcement cooperation. International bodies such as Europol and Interpol use the term in investigative and reporting contexts as an analytical category for this type of organised, compartmentalised crime.
