Topic starter
27/10/2026 7:13 pm
TL;DR: Paid AI account sales surged to 3,845 in Q1 2026, a 640x increase from an average of six a day three months earlier, while 13.2 million criminal account sales were tagged verified, KYC, or 2FA, according to Kasada. That points to AI and verification controls becoming market infrastructure, not edge cases.
Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “KasadaIQ's Q1 Insights: How AI Became Adversary Infrastructure”.
By the numbers:
- In Q1 2026, that number was 3,845, a 640x increase against essentially flat supply.
- 13.2 million account sales on criminal marketplaces in Q1 were tagged verified, KYC, or 2FA.
- Those accounts generated $24.6 million in observed revenue.
Key questions
Q: What breaks when verification is treated as a one-time gate?
A: A one-time gate misses the fact that attackers can buy, fabricate, or bypass identities after the initial check.
Q: Why do AI agents create a different identity risk than human users?
A: AI agents create different identity risk because they operate autonomously, act at machine speed, and often need broad, continuous access to data, tools, and systems.
Q: What are the signs that verification controls are being commercialised?
A: Look for repeated onboarding success by suspicious accounts, spikes in liveness or document failures, reuse of the same device or behavioural patterns, and marketplace evidence of verified or KYC-tagged accounts being sold.
Practitioner guidance
- Govern AI agents as privileged workloads Assign each agent an owner, a defined task scope, and a revocation path so access can be removed as cleanly as it is issued.
- Move from checkpoint verification to continuous trust scoring Extend fraud and IAM decisions beyond signup by evaluating device, behaviour, and session anomalies after authentication succeeds.
- Hunt for verification bypass patterns in onboarding flows Review liveness, document, and 2FA steps for repeated failure modes that correspond to the bypass services described in the report.
Bottom line: AI account sales and verified identity markets are scaling together, which shows that attackers are industrialising access rather than improvising it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/10/2026 9:27 pm
Verification has become a marketplace, not a control boundary. The report shows adversaries pricing verified, KYC, and 2FA-tagged accounts as inventory, which means onboarding checks are now being bought, sold, and reused rather than merely bypassed. That shifts the defender's problem from identity proofing alone to trust persistence after issuance. Practitioners should treat proofing as one layer in a larger fraud control model.
A question worth separating out:
Q: Should organisations govern AI agents differently from chatbots?
A: Yes. Chatbots mainly expose content risk, while AI agents create action risk because they can decide, select tools, and execute in live systems. Governance has to focus on delegated authority, business-process containment, and runtime boundaries rather than conversation safety alone.
👉 Read our full editorial: AI accounts and verified identities are now criminal market commodities