What are account farms and why are they important?

Money muling 2.0 is here. Where fraudsters once relied on deception and risky recruitment schemes, they now have something far more scalable: “account farms” — networks that sell pre-verified bank and payment accounts on demand. 

In Resistant AI’s recent webinar, Money Muling 2.0: Inside the Online Account Farm Economy, we unpacked how these underground marketplaces work, why they matter, and what financial institutions can do to stay ahead. 

What is an account farm? 

Account farms are online marketplaces (often run through websites or encrypted messaging channels) that sell pre-verified bank or payment accounts. 

Who runs the account farms? 

Many operators come from the online document forger markets (template farms). Having sold counterfeit IDs and proof-of-address templates for years, these actors are now bundling those raw materials into complete, ready-to-use accounts. 

The result: chaotic, competitive marketplaces where sellers push thousands of offers daily. 

How are the accounts created? 

Fraudsters use multiple tactics to generate two types of accounts: 

• Consumer accounts. Built with stolen data, fake identities, or account takeovers. 
• Business accounts. Created by fabricating a company, using a shell company or using forged documents to take over a real one. 

Some of the tactics used to create these accounts include: 

• Fake documents. From doctored IDs to AI-generated proofs of address, forging documents helps bypass KYC/KYB checks. 
• Stolen data & synthetic identities. Massive data breaches supply real details like SSNs or dates of birth. Criminals blend these with fabricated info to create synthetic identities that pass registry checks. 
• Liveness checks. Defeated with face-swaps, deepfakes, and manipulated selfies. 

How are the accounts distributed? 

Accounts are sold across encrypted messaging apps like Telegram and through websites that mimic e-commerce shops. Accounts sold through websites still need to use a messaging service for immediate communication (to pass off one-time-passwords and access codes). Escrow is typically used to hold funds and avoid trust. 

Some even use SEO tricks and social media ads to expand outreach and market their services. 

Why are account farms important? 

Account farms turn verified accounts into a commodity, stripping out the friction that used to slow money muling. With instant access to thousands of accounts across platforms, criminals can chain transfers to layer funds and evade detection — faster than ever before. 

Our research revealed a wide area of effect. The blast radius spans 3,000+ institutions and multiple sectors: 

• Banking and payments 
• Exchanges 
• Crypto platforms 
• Marketplaces 
• Remittances 
• Social media 
• Tech infrastructure 
• Enterprise tools 

The speed and ease at which these accounts are opened could be behind the surge in APP fraud — a crime that would be difficult to commit (at the scale it's happening today) with singular accounts tied to human mules. 

Beyond APP fraud, farmed accounts enable mule networks, bust-out schemes, loan and credit fraud, and penetrate other platforms via open banking and partner networks. In short, this is a systemic threat that enables all other types of financial crime that requires an account login. 

What can your organisation do to combat fake accounts? 

Stopping farmed accounts requires more than ID checks or one-off defences. Criminals exploit weak spots across onboarding, behaviour, and transactions, so your risk controls need to work together. 

That means layering document reviews, device signals, behavioural analytics, and transaction monitoring — but also ensuring these layers talk to each other instead of operating in silos. 

At onboarding: Watch for red flags like forged proof-of-income documents, template-farmed IDs, repeated use of the same credentials, or companies that don’t exist in official registries. 

After onboarding: Monitor for telltale mule behaviour: dormant accounts suddenly activating, cycling funds between the same parties, frequent phone/email changes, or abrupt balance swings after contact updates. 

Manual reviews and static rules can’t keep up with this scale or pace. 

That’s why Resistant AI combines document fraud detection, behavioural analytics, and transaction monitoring into a single, adaptive defence. 

By connecting the dots across your risk stack, our models reveal the organized fraud hidden behind seemingly isolated accounts. 

This blog is just a snapshot. To dive deeper, read the full recap, watch the webinar recording, or get in touch with the Resistant AI team.