Tax Fraud on the Darknet and Deep Web: 2023 Update

April 17, 2023

Last year, we covered some emerging trends around tax fraud that our analysts found on the dark web. This year, we’re continuing that theme by highlighting some of the most recent content our analysts found in DarkOwl Vision ahead of tomorrow’s Tax Day.

Read on to see examples of the various forms of tax fraud being proliferated on the the darknet, deep web, and adjacent platforms such as Telegram.

Note: In each example, a screenshot is provided that captures the listing in its original source location, followed by a screenshot of the result as it appears in DarkOwl Vision, our searchable database of darknet content.

Recent Marketplace Listings Aimed at Tax Fraud in DarkOwl Vision

Example Listing: Telegram

Posted on April 4th, 2023 – The Telegram shop FixCombo MarketPlace has numerous recent listings for tax fraud products such as tax returns.

In this example, an advertisement points fraudsters to another Telegram channel that allegedly sells W2 forms as part of its various product listings. In many of these listings, the offers include other associated information to enable criminals to commit digital identity theft, including sensitive information such as Social Security Numbers, Drivers Licenses images and information, past tax returns, W2s, and more.

Figure 1: Screenshot of Listing for PII to Commit Tax Fraud on FixCombo Marketplace (Source, Telegram)

Figure 2: Screenshot of Listing for PII to Commit Tax Fraud on FixCombo Marketplace (Source, DarkOwl Vision)

Example Listings: Dark Web

Posted on March 16, 2023 – Nemesis Market is a dark web onion site that requires authentication to gain access. This marketplace has become more popular in recent months – likely as a result of users seeing a new outlet after other well-frequented marketplaces continue to be taken down via law enforcement operations, such as that of Hydra Market during the summer of last year.

In this example, the vendor “Equifax” is selling a 2023 tax fraud product, including all associated PII needed to file illicitly file on tax return another behalf, for $69 USD.

Figure 3: Screenshot of Tax Fraud Listing on Nemesis Marketplace on Tor (Source, Tor)

Figure 4: (Continued) Screenshot of Tax Fraud Listing on Nemesis Marketplace on Tor (Source, Tor)

Figure 5: Screenshot of Tax Fraud Listing on Nemesis Marketplace on Tor (Source, DarkOwl Vision)

Posted on March 25, 2023 – This listing for Australian tax return fraud tutorials was posted on the authenticated hacking forum, CryptBB. The well-known onion site is predominantly used by English language speakers, and is a darknet site popular among competent hackers, carders and programmers. Many also consider this forum to be a a good place to develop one’s darknet persona and to learn how to improve one’s hacking skills.

In this example, the tutorial was posted alongside a download link, which could be a secondary motive for the vendor – i.e. to install malware on those looking to seek to download the tutorial.

Figure 6: Screenshot of Country-Specific Tax Fraud Mechanisms on Dark Web Market CryptBB (Source, Tor)

Figure 7: Screenshot of Country-Specific Tax Fraud Mechanisms on Dark Web Market CryptBB (Source, DarkOwl Vision)

Example Listing: Deep Web

Posted on March 7, 2023 – This posting on the deep web site XSS is for a 2023 – 2024 “Tax Refund Method Tutorial.” Certain sections of the forum requirement payment via escrow services in order to receive full access.

XSS is considered to be one of the most popular deep web hacking forum among Russian cybercriminals.

Figure 8: Screenshot of Tax Refund Tutorials on the Deep Web (Source, XSS)

Figure 9: Screenshot of Tax Refund Tutorials on the Deep Web (Source, DarkOwl Vision)

Fraud is one of the most common motivations for crime on the darknet, and comes in many different varieties. To dive deeper, our analysts highlighted some other methods used to commit fraud in a webinar that you can watch on demand.