The Dead Drop
FRAUD · POWER · PSYOPS
He wrote the fraud once and let the robots run it.
|
Nikki Sokolov did not sit at a keyboard opening fraudulent accounts one at a time. That is the old way, the patient way, the way that gets a man caught. He did something worse. He taught software to do it for him, and then he went to sleep.
The story comes out of Tsur Yitzhak, a quiet town in Israel, the kind of place where nothing is supposed to happen. Israeli police say Sokolov pulled leaked identity data off the internet: ID cards, credit cards, photographs, the spillage of old breaches that sits for sale on Telegram for anyone with the nerve to buy it. He had the raw material. What he did with it is the part that should keep you up.
He animated the dead photos. He fed a stranger's ID picture into AI and out came a living face, a face that blinked and smiled and turned its head on command. Then he pointed AI agents at the banks. The agents built the videos. The agents filled out the applications. The agents passed the remote identity checks that banks spent years telling themselves could not be faked. Sokolov wrote the crime once. The machines ran it again, and again, and again.
The numbers tell you how well it worked. More than 60 stolen identities. Around 120 people who filed complaints. Roughly 90 warrants. More than $50,000 in credit card proceeds, and that is only what they could count. Most of the victims never knew a thing until a detective called them in and played them a video of their own face, speaking words they never said. Imagine that. You walk into a police station to report nothing, and they show you yourself, smiling, alive on a screen, in a clip you were never in.
He only had to build it once, and let the robots wear it. That is not a clever criminal. That is a preview of the next ten thousand.
Sokolov did not invent any of this. He shopped for it.
Somewhere on Telegram tonight there is a price list, and it reads like a diner menu. Synthetic video, verification grade, built to survive a live selfie check. Voice clone, three minutes of source audio, next-day turnaround. A KYC bypass kit tuned to a named bank, coaching included for when the agent pushes back. A jailbreak pack, updated weekly, troubleshooting channel thrown in for free. Payment in crypto. Buyer reviews underneath, the way you would rate a phone case.
Not one of the sellers built it from nothing either. They bought the parts, bundled them, marked them up, and posted the listing again this morning. A man in a quiet Israeli town pulled those parts off the shelf, pointed software at the banks, and turned 60 stolen faces into cash while he slept. He is not the exception. He is the customer the catalog was written for.
The deepfake was never the weapon. The store was.
The new fraud ring is not a gang. It is a factory: leaked faces, fitted onto agents that never sleep.
Flashpoint analysts spent May inside those marketplaces, and they came back with a number worth reading slowly. 2,910,012 posts in a single month on how to point artificial intelligence at the rest of us. In April it was 2,328,958. That line is not climbing. It is breaking upward, by more than half a million posts in thirty days.
A number that size is easy to dismiss as noise. It is not noise. It is a catalog growing in real time.
And the most important finding in the report is the one that sounds like good news. This month, the chatter about building custom criminal AI models went down. The chatter about reusing other people's prompts, bundling other people's kits, and porting working methods onto friendlier platforms went up. The criminals have stopped inventing. They have moved into manufacturing and sales.
You are not watching a laboratory anymore. You are watching a market find its feet.
|
◆ THE OPERATIVE'S OBSERVATION
For 30 years the comforting truth about serious cybercrime was that it took talent. Emptying a corporate account required someone who could code, who could social-engineer, who could improvise when a target went off script. Talent is rare. Rare is slow. Slow is survivable. That moat is draining. When the skill gets baked into a product, the product does not care who buys it. A kit runs the same in the hands of a bored teenager as in the hands of a career criminal. The labor pool for high-grade fraud just widened from a few thousand specialists to anyone with a phone and a grievance. Crime just discovered the franchise model. A franchise does not need a genius behind every counter. It needs a working recipe, a supply line, and enough locations. In this business the recipe is the prompt. The supply line is Telegram. The locations are us. |
The Flagship Product
Every market has a bestseller. In this one, it is your identity.
Of those 2.9 million posts, Flashpoint tracked 1,784,716 in May alone advertising or discussing how to defeat identity verification. The selfie check. The live video. The hold-your-ID-and-turn-your-head ritual that your bank, your exchange, and your brokerage all use to decide you are you. More than 1.7 million sales pitches in one month for a single product line. That is not a hobby. That is a department with a quota.
The listings are specific the way real products are specific. Synthetic video engineered to pass a live check, not just to look good in a clip. Voice clones packaged with scripts for the second a human agent answers. Bypass kits tuned to named onboarding systems, the target's logo all but printed on the box. Premium bundles that ship a synthetic face, matching documents, and an AI-written script as one unit, so a buyer can open an account out of thin air without understanding a single piece of how it works.
Identity is only the front of the store. In the back, it bolts onto everything else already on the shelf: stolen passwords, hijacked session tokens, phishing infrastructure. The buyer does not assemble an attack from knowledge. He assembles it from purchases, like a man building a desk out of parts he ordered separately and snapped together on the living room floor.
The wall your bank built to keep criminals out is the single most heavily marketed product in their catalog.
| ◆ |
The Supply Line
The genius of this market is not the products. It is the logistics.
Most of it moves on Telegram. Not the dark web of your imagination, with its onion addresses and its theater of secrecy. A chat app on the phone in your pocket. The same offers spray across thousands of subscribers at once, the wording adjusted when a platform cracks down, the listing reposted the moment it stops converting. Forums host the long technical talk and the seller reputations. Paste sites and code pages warehouse the scripts. Different rooms, one open floor plan, every door connected.
Follow one product as it travels and you understand the whole machine. A jailbreak prompt, which is nothing but a paragraph of careful wording that talks a mainstream AI past its own safety rules, is born in a chat room. By morning it is on a forum with cleaner phrasing. By night it has been copied to a paste site and blasted back out through Telegram. When the AI company patches the hole, buyers compare notes and ship a fixed version within hours, with a troubleshooting channel attached. There is, functionally, customer support for crime.
Across every source Flashpoint watched, the buyers wanted the same four boring things, and not one of them is talent. Outputs that work the same way every time. Methods anyone can reuse. A reliable route around the guardrails. Parts that snap into the fraud tools they already own. Those are not the demands of inventors. They are the demands of customers.
This is how AI crime actually scales. Not a breakthrough in a basement. A distribution network that never closes.
Field Manual
5 defensive controls for a de-skilled adversarial landscape.
| 01 | Kill callback improvisation. Any payment, password reset, payroll change, account recovery, or vendor banking update needs a known-number callback. Not the number in the message. Not the number in the email signature. A number already in your system. AI makes the incoming request prettier. Your defense is an outbound path the attacker did not supply. |
| 02 | Treat live video as evidence, not proof. A face on a call is now a claim, not a guarantee. For high-risk actions, require a second channel and a pre-agreed phrase or workflow. The point is not to spot the deepfake. The point is to make the deepfake insufficient. |
| 03 | Harden account recovery. KYC bypass talk is exploding because onboarding and recovery are soft targets. Remove security questions that can be scraped. Add device history, transaction behavior, step-up checks, and human review for high-value changes. Recovery is the side door. Stop treating it like customer service trivia. |
| 04 | Assume the script is fluent. Bad grammar is dead as a primary warning sign. Train people on pressure, channel-switching, secrecy, urgency, and payment rails instead. The scam email will not always sound foreign, sloppy, or weird. It may sound exactly like your vendor after a model cleaned it up. |
| 05 | Watch for kits, not just incidents. If you work fraud, security, payments, HR, or trust and safety, monitor the workflows being advertised against your control layer: KYC bypass, fake applicant video, refund scripts, account recovery prompts, payroll diversion lures. The attack shows up in the market before it shows up in your queue. |
|
◆ THE FRAUDFATHER BOTTOM LINE
Stop picturing a hooded genius. Picture a storefront. |
|
GRAY MATTERS · THE ASSEMBLY LINE
Crime Found The Factory.Every trade fears the same ghost. The craftsman fears the factory. For most of history a skill was a wall around a living. The blacksmith, the cobbler, the typesetter, the locksmith. The skill took years to earn, which meant few people had it, which meant the ones who did were valuable and the ones who wanted their work had to pay. Talent was scarce, and scarcity was the whole economy. Then the factory arrived, and the factory did not make better craftsmen. It made the craftsman unnecessary. It broke the work into steps simple enough for an untrained hand to run one, built a supply line to feed those hands, and the thing that once took a master a week came off the line by the hour. The skill did not vanish. It got poured into the machine, and the machine got sold. The factory never needed talent. It needed a recipe, a supply line, and enough hands to run them.
Crime just had that moment. For 30 years the protection most of us never thought about was that serious fraud was hard. It took a particular kind of person: patient, clever, willing to learn a craft in the dark. That scarcity guarded you more than any password did. There were only so many of them, and they could only be in so many places at once. The marketplace Flashpoint mapped is the factory for that craft. The deepfake, the bypass, the jailbreak: each one is the master's skill, poured into a product and set on a shelf. The buyer needs no patience, no cleverness, no years. He needs a wallet and a grievance. Those 2.9 million posts are not 2.9 million masterminds. They are a supply line feeding a million ordinary hands. This is why the old advice ages so badly. We taught people to spot the criminal: the bad grammar, the clumsy story, the strange account, the tell of an amateur working alone. The factory erases the tells, because the factory does not sell amateur work. It sells the master's work at the amateur's price. Whatever lands in front of you will be polished, because polish is the product now. You can no longer defend yourself by spotting bad work. You defend yourself with a rule the best work in the world still cannot pass. That rule is dull on purpose. The second channel. The shared word. The slow minute when the money is moving and the moment is loud. A perfect forgery still cannot tell you a secret it was never given, and it still cannot be in two places when you hang up and call back on a number you already trusted. The factory can mass-produce the lie. It cannot mass-produce your discipline. That is the one part of this they have not figured out how to sell. Stay sharp. Trust slowly. Verify everything.
The Fraudfather
|
This newsletter is for informational purposes only and promotes ethical and legal practices.