There is an industry that has pricing plans, monthly subscriptions, HR departments, performance reviews, KPIs, and AI copilots. It generated more than $400 billion last year. It isn't Silicon Valley.

In this piece, I’ll look at how AI has changed fraud, how this system works, discuss salaries for fraudsters, and share some thoughts on how to fight it.

System of a Down

Most large-scale fraud schemes are not run by lone hackers, but by entire factories. I often think back to the well-known example of Asian “scam compounds” that came into the spotlight in 2024.

The UN estimated the number of “employees” working in these compounds at 300,000 people, TIMES

And when I call it a corporation, I am not exaggerating. Researchers Mark Bo, Ivan Franceschini, and Lin Li describe these compounds in their 2025 book Scam as genuinely developed organizations: inside a “scam company,” there are cafeterias, clinics, and brothels; employees operate multiple phones at the same time from early morning until midnight, and failure to meet targets is punished with beatings.

These companies use the same principle of division of labor as legitimate businesses. As the anti-fraud service,

Inside these fraud corporations, workers actively use modern technologies to meet the KPIs set by their employers. In the age of AI, criminal groups obviously could not ignore technologies that became available so cheaply. Fraudsters use deepfakes to “carry out social engineering schemes with frighteningly high efficiency, exploiting people’s trust and emotions,”

Fraudsters use deepfakes for fake investment campaigns, create pornographic material, and also steal other people’s identities - usually those of influential individuals - exploiting their reputation to commit crimes.

The Industry Price List: What Everything Costs

The market for fraud tools is structured much like the legitimate SaaS market: subscriptions, pricing tiers, and customer support on Telegram.

Deepfakes and Synthetic Identities

According to Group-IB, a synthetic identity package - an AI-generated face, a cloned voice sample, and forged documents - sells on underground marketplaces

More advanced LLM-based fraud tools, such as FraudGPT and WormGPT - versions of language models with their safety guardrails removed - are sold on a subscription basis for $200-1,700 per month.

Verification Bypass

There is also a service in which a live operator uses a deepfake face swap to pass biometric verification on behalf of a client. The cost ranges

Phishing

Ready-made phishing kits are often distributed for free. The menu also

At its peak, this malware was used in attacks targeting more than 500,000 organizations per month, until Microsoft and Europol carried out a coordinated takedown of 330 domains in March 2026.

What else? There are also subscriptions offered under the

Salaries in the Legitimate AI Market vs. "Salaries" in Scam Factories

Paradoxically, recruiters for scam compounds

For example, Shuaibu, a 24-year-old Ugandan,

The return on investment is equally striking.

Jobs Inside the Fraud Economy – and the Layoff Paradox

This economy has its own professional hierarchy, one that almost perfectly

This is where the central paradox emerges. On the one hand, the legitimate job market is undergoing layoffs driven by automation: routine tasks, call centers, and document processing are all increasingly being taken over by AI. On the other hand, that same AI is creating demand for labor in the underground fraud economy. It is entirely possible that some of this demand is being filled by people who have been displaced from legitimate industries by automation.

Interestingly, recruiters for scam compounds deliberately

At the same time, as Fortune

Experian already

In other words, AI isn't just changing the labor market "somewhere out there." It is simultaneously pushing people out of legitimate employment, creating a shadow labor market for them, and then beginning to automate that market as well.

So What Do We Do About It?

AI-powered fraud is not a collection of isolated incidents – it is a system. Behind a single scam call, there is often a $30 subscription to a deepfake service, a $5 synthetic identity package, a script generated by an unrestricted language model, and an operator in a scam compound trying to hit a daily quota under the threat of punishment. It is an assembly line, not an isolated event.

The practical conclusion is that we need to respond not to individual scams, but to the infrastructure that produces them – from data centers and telecom providers to payment gateways and cryptocurrency exchanges through which the money is laundered. This is already the approach taken by major law enforcement operations. For example, in May 2026, Europol