Fraud is increasingly being organised as a service, with criminal groups able to buy data, infrastructure, tools and specialist expertise rather than developing every capability themselves.
ZIGRAM’s analysis highlights how this shift is creating a more fragmented financial crime environment for banks, FinTechs and payments firms, particularly where fraud and anti-money laundering (AML) systems operate separately.
The scale of the model was illustrated in October 2025, when Europol dismantled a criminal network operating a SIM-card rental service across roughly 80 countries. The operation supported phishing, smishing and identity concealment and was linked to more than 49 million fake accounts and thousands of fraud incidents across Europe. Rather than operating alone, the criminals relied on purchased tools, rented infrastructure and other specialist services.
This model is known as Fraud-as-a-Service (FaaS). It allows criminal actors to outsource parts of a fraud operation through services that can include phishing tools, stolen data, synthetic identity packages, forged KYC documents, account takeover capabilities, mule recruitment and other forms of infrastructure.
FaaS has similarities with legitimate Software-as-a-Service models, with some criminal services offering subscriptions, different pricing levels, customer support and instructional material. Europol’s IOCTA 2025 report found that crime-as-a-service platforms are supplying stolen credentials, data and fraud tutorials at scale.
The result is a more specialised criminal ecosystem in which different participants can provide different capabilities. This creates a chain that stretches from the acquisition of stolen information through to fraud execution, movement of proceeds and money laundering.
Stolen credentials, card information and customer data can provide the starting point. Other services then supply the tools and infrastructure required to conduct account takeover, new-account fraud, authorised push payment scams and refund fraud. Proceeds can subsequently move through mule accounts, e-wallets and crypto on and off-ramps before being layered through other entities and financial channels.
The financial impact is significant. Juniper Research estimated that ecommerce fraud cost organisations $41.4bn in 2022. More broadly, FATF’s 2026 report identifies fraud as a major money laundering risk in 90% of assessed jurisdictions.
Other indicators point to the growing scale of identity-related fraud. Experian reported that identity fraud cases increased by approximately 60% in 2024, with synthetic identity fraud accounting for 29% of cases. FinCEN found that around 42% of suspicious activity reports involved identity exploitation, representing approximately $212bn in suspicious activity in 2021. TransUnion data also showed synthetic identity fraud volume increasing 184% between 2019 and 2023.
Technology is adding another layer to the problem. Artificial intelligence can be used to generate synthetic identities, forged documents and deepfake material, while large language models can help create more tailored phishing and scam content. Automated tools can also adjust fraud activity as criminals encounter changes in financial institutions’ controls.
US account takeover losses exceeded $15.6bn in 2024, according to the Federal Reserve. The increasing use of automation means financial institutions may have less time to identify and respond to emerging attack patterns.
For banks and other financial institutions, the challenge extends beyond fraud detection itself. Money generated through fraudulent activity can subsequently enter the same financial systems monitored by AML teams.
A customer or entity involved in fraud may therefore appear later in transaction monitoring or other AML processes. However, where fraud detection, transaction monitoring, KYC, screening and adverse media are managed through separate platforms, different teams may only see individual parts of the same activity.
This creates a case for connecting fraud and AML data rather than treating them as entirely separate areas of financial crime management. Fraud indicators such as unusual account activity, device changes and account takeover attempts can provide additional context when considered alongside customer risk information, ownership structures and transaction patterns.
A range of capabilities can contribute to this approach, including continuous entity intelligence, behavioural analytics, transaction monitoring, graph analytics, dark web monitoring and integrated case management. Multi-factor authentication remains an important baseline control, but the wider FaaS model means institutions also need visibility across the different stages of financial crime activity.
This is where the concept of FRAML, which combines fraud and AML within a connected operating and data model, has gained attention. Rather than maintaining separate systems and teams that identify different elements of a case, the approach seeks to connect fraud detection, transaction monitoring, entity intelligence and other financial crime signals.
ZIGRAM’s FRAML framework brings together name screening through PreScreening.io, transaction monitoring through Transact Comply, entity intelligence through Entity Hero and fraud monitoring through Fraud Fighter.
As ZIGRAM’s analysis shows, the broader issue is the relationship between the different parts of the criminal ecosystem. FaaS allows individual actors to specialise while relying on other participants for capabilities they do not develop themselves. For financial institutions, detecting one element of that activity may therefore provide only a partial view of the wider risk. Connecting fraud and AML signals can give institutions a broader view of activity across customers, transactions and entities.
Copyright © 2026 FinTech Global
