How to Speak Dark Web: Illicit terms, products and services

Language is Fluid

Language is dynamic and words change meaning over time. In the past, geographic distance and lack of communication slowed this process and caused common languages like Latin to devolve into Spanish, French, Italian, Portuguese, and Romanian. Today, instant global-scale communication through digital media allows slang to change as fast as hairstyles. “On point” started as a difficult maneuver for a ballerina, then switched to a dangerous position in an infantry squad patrolling a jungle, and is now somehow a reference to beautiful eyebrows. Every subculture develops a language of its own, not just on the dark web.

Criminal Finance Linguistics

Finance people talk of bonds, basis points, and yields. Understanding the slang, terminology, and acronyms of a subculture is a foundational aspect of understanding the culture and either becoming a part of it or, as in the case of fighting financial crime, bringing it down. 

Criminals, especially in the drug world, have always been famed for using slang pseudonyms and euphemisms to discuss illicit and dangerous things. My son asked me yesterday why a comic book hero wanted to stop people from being in the coke business. What’s wrong with Coca-Cola?, he asked. I guess it was time to have a conversation about drugs.

On the dark web there is an entire illicit ecosystem that mirrors the legitimate Financial Services industry. These are people who understand the unique language of Finance and have developed a unique language to discuss exploiting that system. We are unlikely to defeat an opponent we do not actually understand. Therefore, I invite the financial crime investigators of the world to learn a few terms common to elicit actors offering dark web Financial Services.

Dark Web Shadow Monetary Products and Services

While the black market is not a place in real life, its virtual equivalent is alive and well on the dark web. Like an evil version of 1990’s Craigslist, there are link-tree sites for any illicit service one can imagine. Some marketplace pages for underground banking look like a dark-mode knock-off version of eBay, complete with seller ratings and reviews. Offerings include every conceivable way to defraud financial services firms, acquire identities, invent companies, move money, and cash out. Some illicit firms even offer covert brokerage services and portfolio management. This section explains the most common terms used to reference specific illicit products and services:

Accounts and Access

These marketplaces sell a variety of types of accounts or access to financial services from all imaginable types of financial institutions. To do so, accounts are either compromised, taken over, or opened fraudulently. No matter what the illicit use of the account becomes, all of these accounts are accessed or opened in two major ways. Generally, either a consumer’s account is taken over, or fraudulent documents are used to open an account.

Stolen identities, data breaches, and hacked credentials are all used to take over accounts or use them without the owner’s consent. A money mule is a person who, knowingly or unknowingly, uses an existing account to facilitate laundering, usually for compensation. The second major category involves the criminals themselves opening accounts using stolen or synthetic identities. The next section explains common terms for these uses and methods.

Cashout: Converting cash 

This is the service of exchanging cash to or from electronically held funds, digital assets, or even physical commodities. Named for the final step of a fraudster or launderer’s journey, these are individuals who facilitate converting physical hard currency, usually US dollars, to some other form. Despite the name, they are often willing to convert assets in both directions.

Drops: Bank Accounts for Cashout

While cash out refers to the service, individual, or entity conducting the service, “Bank drop” or “Drop” refers to the accounts used in the process. These accounts allow a money converter to move some form of digital funds, often cryptocurrency or foreign currency, into a bank account in the user’s local currency. The cashout provider, or the illicit user, then exploits ATM networks, makes branch withdrawals, and otherwise removes hard currency to facilitate the transaction. In reverse, a drop might be used to deposit funds the cashout dealer has acquired from a courier.

Loaders: Bank Accounts for Layering

Loading accounts are used for a strange mix of things. Sometimes they are accounts which are rented for pass-through purposes. These may either be accounts that were taken over, or created with synthetic identities, or stolen with created with stolen identities. Sometimes, loading accounts already contain a balance. A user can purchase such an account using a variety of methods; the account is sold with the balance intact for a slightly larger fee.

Creds: Account Credentials

Login credentials and other access related materials, including out of wallet questions, are available under different names. Creds is short for credentials.

Log: Account Credentials

Log is short for login information, also refers to the credentials necessary to access and account, usually digitally.

Fulls/Fullz: Full Account Credentials

This means the package for sale is not just temporary use or partial access, not simple online login information, but the complete keys to an account relationship. As with anything, it may be partly marketing and not always different from other credential offerings.

Inny: Institutional Insider

Any is short for insider, slang for a compromised employee who will facilitate illicit transactions and compromised account opening or usage. Consider that many frontline bank employees are relatively low paid and, with pressure to look like successful salespeople, can be susceptible to graft and corruption. Illicit actors usually target mid-level management who tend to have approval thresholds over escalated risk and larger transaction amounts.

Legit: Accounts Opened by Criminals

Accounts that were opened using either a working stolen Identity or a synthetic identity are considered legit. This is different than a compromised account where the person who opened the account has lost control of it due to compromised credentials. Legit accounts were opened from day one using a falsified or stolen identity, giving them a lower likelihood of being instantaneously discovered and shut down because of user complaints.

Fresh: Account Opened Recently

Recently opened accounts are known to be treated differently because they lack account history and often take on a larger than normal transaction or balance transfer in the opening funding process. This has certain advantages for those looking to exploit the newness of the account and the window of time during which alert analysts may be likely to excuse sudden changes in behavior. Yes. Criminals understand Bank processes this well.

Aged: Account Established

Conversely, aged accounts are those which have a well-established history, indicating that they are useful for hiding and or layering funds, and sometimes for sustained operations. Again, any such compromise, stolen, or falsified accounts are both rented and sold at a high volume on the dark web.

Communication Styles, Slang and Other Terminology

In communicating with one another, criminals can be very frank and no nonsense. Since every communication is high risk, every interaction is high risk, and the entire business is high risk, people tend to not tolerate uncertainty, drawn out conversations, or people who are unfamiliar with the process. One exception is self-proclaimed noobs, who seem to get a pass by admitting their own ignorance.

Newbie / Noob: New to the business

A person who is a recent entry to dark web activity, fraud, and money laundering as a service. This is a well-known term in gaming, and often seems to be used as an excuse for people who are just getting started but may not know all of the local customs.

Don’t Waste My Time

Like any business executive, criminals on the dark web behave like busy, important folks. What they offer is a valuable commodity, and they understand the game of percents better than most Wall Street brokers. The phrase, don’t waste my time, appears over and over in ads and conversations.

Legitimate Business

Immediately after rushing one’s potential clients, these spidery sales people often follow up by reminding us all that they are running a legitimate business. I think that word does not mean the same to them that it does to us…it seems to refer to the fact that the money is real and available, and that the service is well organized to meet the criminals’ needs. Legitimate means it’s going to happen, as long as you don’t waste the proprietor’s time.

Speaking Dark Web Jargon

While this lingo is unlikely to make it into transaction descriptions or paper check memo lines, being aware of the terminology helps the investigator or analyst understand the criminal mindset.

Social media posts, seemingly casual open source or open web postings may contain subtle references to these things. It is not uncommon for proprietors of such services to be bold and ostentatious about their wealth in today’s world of disclosure and self promotion. 

Transaction red flags are likely similar to those you already see: rapid pass through accounts, compromised credentials leading to rapid draining of funds, or the tried and true cash structuring and smurfing methods. Yet, when you combine that with intelligent open source research that is privy to coded language of people committing crimes, it is possible to uncover some of this activity and fight the long fight against fraud and financial crime.