Georgia State University researcher David Maimon and his team documented how criminals are using dark web markets to buy stolen checks, open thousands of sham bank accounts, and launder money , all while bypassing the credit freezes that Americans have been told protect their identity. A credit freeze stops fraudulent credit card accounts, but it does nothing to prevent someone from opening a bank account in your name.
What They Found on the Dark Web
Maimon’s team was monitoring underground markets when check images started appearing in large quantities around mid-2021. At first glance, checks aren’t the most obviously valuable criminal commodity. But the sheer volume of them made the researchers pay attention.
The pattern that emerged was specific. Criminals were buying checks in bulk and then depositing them across multiple accounts simultaneously. One criminal would deposit three different stolen checks into three different bank accounts, each opened under a different stolen identity. Multiple accounts, multiple deposits, multiple identities , the approach was clearly designed to spread the activity thin enough to avoid automated fraud flags at any single institution.
The mechanism for doing this at scale was the debit card.
Maimon’s team observed large numbers of debit cards being sold on the same dark web markets. A criminal who buys a stack of debit cards linked to sham accounts has the infrastructure to deposit a matching stack of stolen checks. The two product categories — stolen checks and ready-to-use debit cards , were working in tandem. The dark web market was essentially a one-stop shop for check-washing fraud.
The connection between check theft and dark web markets connects directly to how mail theft and physical fraud techniques are being used alongside digital criminal infrastructure , stolen checks frequently start with mail theft, before the images or physical instruments are listed for sale online.
The Zero-Balance Account Screenshot
Then in June 2022, the team observed something they hadn’t expected to see.
Criminals started posting screenshots of bank account interfaces , accounts showing zero balances. Maimon’s first reaction was to wonder why anyone would advertise an empty account. The answer took a moment to land: those screenshots weren’t proof of failure. They were product listings.
A bank account with a zero balance is a clean account. No transaction history. No connection to previous fraud. No flags in the banking system. For a criminal who wants to deposit stolen checks and move money without detection, a clean zero-balance account with an attached debit card is exactly what they need.
The dark web market had evolved from selling individual stolen checks to selling the entire infrastructure for check fraud: the checks themselves, the debit cards to deposit them, and the clean accounts to receive them. What Maimon’s team was watching was a mature supply chain for financial crime.
Over a six-month period, they tracked a single criminal’s activity , counting how many credit card images and zero-balance account screenshots they posted. What they saw was growth. And around that one actor, they saw copycats appearing, running the same operation.
This mirrors exactly what we’ve seen in how dark web financial fraud markets operate with competitive pricing and reputation systems , when one actor demonstrates a model that works, others copy it rapidly.
The Credit Freeze Gap Nobody Is Talking About
This is the finding that Maimon describes as critically underappreciated.
Most Americans who have thought about identity theft protection have been told to freeze their credit. It’s standard advice, it’s free, and it works well for a specific category of fraud: someone trying to open a credit card or take out a loan using your Social Security number. A credit freeze tells the credit bureaus to reject any credit inquiry on your file unless you lift the freeze yourself.
But here’s what the advice leaves out: a credit freeze has no effect on bank account applications.
When someone opens a bank account, the bank doesn’t necessarily run a credit check through Equifax, Experian, or TransUnion. They may run a ChexSystems check , a separate reporting network that tracks banking history but ChexSystems operates independently from the major credit bureaus. A credit freeze at the three major bureaus leaves this pathway completely open.
Maimon is direct about why this matters. “With bank accounts, it’s a different story, because the credit freeze does not affect your ability to establish a new bank account under someone else’s name.” A criminal who hits a frozen credit file when trying to open a credit card can simply pivot to opening a bank account instead and the same stolen identity that couldn’t get a credit line can still get a checking account, a debit card, and a deposit infrastructure.
This is precisely the gap the check fraud ecosystem is exploiting at scale. The FBI’s Recovery Asset Team works hard to freeze funds after fraud is reported, but the effectiveness of that response depends on victims noticing and reporting quickly. Sham account fraud is designed to be slow and distributed enough that it often isn’t noticed until money has already moved.
Sports Betting as the Next Money Laundering Frontier
Maimon’s team is now tracking a new direction in how the proceeds from this scheme are being moved. The next research focus is the intersection of sham bank accounts and sports betting.
Legal online sports betting has expanded rapidly across US states in recent years, and with it, the financial infrastructure of betting platforms , accounts, deposits, withdrawals, and payouts. Maimon describes this as the next layer of money laundering the team is working to document: how identities stolen for sham bank accounts are then being used to cycle funds through sports betting platforms, creating another layer of distance between criminal proceeds and traceable bank activity.
This evolution , from dark web markets to sham bank accounts to legitimate-appearing sports betting activity , is consistent with how sophisticated money laundering operations layer transactions to make criminal funds increasingly difficult to trace as they move further from the original crime.
What You Can Actually Do
Maimon’s advice is practical but goes slightly beyond the standard guidance most people have heard.
Freeze your credit at all three major bureaus , Equifax, Experian, and TransUnion at AnnualCreditReport.com. This is the standard first step for a reason. It stops a major category of identity-based fraud even if it doesn’t stop everything.
But also consider adding a ChexSystems security freeze. ChexSystems is the bank-specific equivalent of the credit bureaus , it’s the reporting service many banks check when you apply for a new account. Freezing your ChexSystems file adds the protection that a standard credit freeze doesn’t provide, specifically for bank account fraud.
Use identity theft monitoring services that alert you in real time when someone attempts to use your information. The gap between a credit freeze and a ChexSystems freeze is wide enough for this category of crime to operate in, and monitoring gives you early warning rather than waiting until you notice unexplained account activity.
Monitor your bank accounts daily, not monthly. The sham account scheme involves criminals depositing checks and moving money quickly. The shorter the window between a fraudulent transaction and your discovery of it, the more likely recovery becomes.
For a complete guide on what to do when your personal information may already be in criminal hands including where to report fraud and how to dispute fraudulent accounts , our dark web data exposure guide covers the full checklist.
Frequently Asked Questions
What is the dark web check fraud scheme?
Criminals buy stolen checks from dark web markets, open sham bank accounts using stolen identities, use purchased debit cards to deposit the checks, and launder the proceeds. The operation is designed to spread activity across enough accounts to avoid detection.
Why doesn’t a credit freeze protect against this?
A credit freeze stops fraudulent credit card and loan applications through the three major credit bureaus, but bank accounts can be opened through a separate system called ChexSystems. A credit freeze has no effect on someone opening a bank account using your identity.
Who discovered this?
Professor David Maimon and the Evidence-Based Cybersecurity Research Group at Georgia State University documented the scheme through multi-year monitoring of dark web markets, working with The Conversation’s Kurt Eichenwald to publish the findings as “Heists Worth Billions.
What should I do beyond a credit freeze?
Add a ChexSystems security freeze, use identity theft monitoring with real-time alerts, and check bank accounts daily rather than waiting for monthly statements.
