Fraud-as-a-service

Ready-made fraud tools and services sold or rented to anyone, the same way legitimate businesses buy software as a service, so running a scam no longer requires technical skill.

A would-be fraudster can pay for a phishing kit, a stolen data set, or a deepfake tool, and get working instructions along with it.

A criminal economic model in which fraud infrastructure, deepfake generation, phishing kits, stolen-data marketplaces, agent orchestration tools, is packaged, modularized, and rented out, lowering the skill and cost barrier to running an attack from expert-level to essentially none.

The model mirrors legitimate software businesses in several ways:

• Packaging, where tools come ready to use with instructions.
• Subscription or pay-per-use pricing, where buyers rent access instead of building anything.
• Specialization, where one group builds tools, another sells stolen data, and another runs the attacks.
• Support, where sellers offer help and updates to their customers.

Common products and services include:

1. Phishing kits, which are ready-made fake login pages.
2. Stolen-data marketplaces, which sell credentials and personal details in bulk.
3. Deepfake and voice cloning tools, which generate convincing fakes on demand.
4. Automation tools, which run attacks at scale across many accounts.

Fraud-as-a-service sits next to terms that are easy to mix up:

• Agentic fraud uses autonomous AI agents to run scams, and rented tools can supply those agents.
• Voice cloning is one capability that rented tools make easy to use.
• Bot attack describes automated traffic, which fraud services often run.

For a related model in another form of cybercrime, see Ransomware as a Service. What Is It and Why Is It a Threat?.