January 26, 2023by Adi Bleih

Dark web market listings for counterfeit banknotes up 91% last year

Despite endless pronouncements that cash is dead, the underground market for fake money is thriving. In 2022, there was an approximately 91% increase in deep and dark web market listings advertising counterfeit banknotes (Figure 1). During this time, the number of unique actors selling these fake bills increased by approximately 82%.

Figure 1: Listings of counterfeit currency on underground markets

Notably, the top 10% of sellers are responsible for 80% of total listings. Therefore, even as more actors become involved in the trade, a small number of actors are responsible for most of the market. Possibly, they have more comprehensive operations, with higher capabilities for production and shipment.

The vastly increased supply and growth of suppliers of counterfeit currency may result from the proliferation of advanced printing technology and techniques, which enable more actors to produce convincing counterfeits with less difficulty. For example, a Massachusetts man was recently sentenced to prison after printing over $400K in fake bills in an at-home operation that used an inkjet printer.

Furthermore, the rise in supply implies an increase in demand as well. As a result, criminals may increasingly purchase and use fake banknotes from the underground to finance their illegal activities.

An examine the quantity of feedback given to these market listings implies that this currency is of higher quality: Despite the overall rise in fake money advertised on the underground, there was an approximately 53% decrease in feedback (replies) to these listings.

Suppose we assume customers are more likely to write feedback when dissatisfied with the transaction. In that case, the inverse relationship between posts advertising counterfeit money and feedback on these posts suggests that customers are increasingly satisfied with the product and the supplier.

Figure 2: Example of feedback on counterfeit money product quality

Figure 3: Example of different feedback on counterfeit money products and shipment

Quality and Usage

There are several qualitative standards that banknotes must meet. Sellers list these standards in the descriptions of almost every post advertising counterfeit money (Figures 4 and 5). For example, sellers generally guarantee that bills are untraceable, contain watermarks, and are capable of passing fake pen tests (which detect starch, a substance found in most paper but not in the paper used for American currency). Sellers also specify the uses for which their counterfeit bills are suitable. For example, some bills are suitable for on-site cash payments at stores and retail locations. Other bills are ideal for ATMs, money changers, casinos, or vending machines.

The type of use can reflect the quality of counterfeit bills. Higher-quality bills will pass automated detection methods, such as those used by ATMs or other money-processing machines that detect fake bills. Sellers attempt to attract buyers by listing various uses for their counterfeit money.

Figure 4: Ad for bills that can’t pass machine checks

Figure 5: Counterfeit money advertisement describing the quality and suitable uses

Figure 6: Advertisement listing tests that fake bills can pass, according to the seller

Prices and Payment Methods

In the counterfeit money market, prices can signal product quality and seller reputation.

Prices that appear too high or too low may raise red flags for potential buyers about the product and the seller. Generally, sellers require minimum order sizes (Figure 10), adjusting prices based on the quality (grade) of the bills (Figures 7, 8, and 9 ).

Figure 7: A listing selling counterfeit USD for $0.10-$0.11 per fake dollar

Figure 8: Threat actor offers $6,000 of counterfeit money for $300 (one fake dollar cost - $0.05) . The actor will deliver in a variety of currencies, including USD, AUD, CAD, Euro, and GBP

Figure 9: Threat actor offers $5k,000 of counterfeit money for $200

Figure 10: Minimum order is $800

Some sellers require additional verification steps when orders exceed a specified amount, such as face-to-face (F2F) meetings (Figure 11), to avoid scammers or to evade the authorities.

Figure 11: The actor requires face-to-face verification for orders that exceed $100,000

Sometimes, sellers require a set amount of counterfeit notes to be purchased. These sellers won’t fill small-volume orders, even though many buyers want to check the quality before making larger purchases (Figure 12). While sales in specific lots could indicate that an operation is shutting down, they may also be a strategy to limit sales to serious buyers.

Figure 12: The actor requires face-to-face verification for orders that exceed $200,000

Shipment and Refunds

Threat actors generally ship counterfeits through standard services, such as the US Post Office, UPS, and FedEx. (Figure 13) Certain sellers include the shipping rate in the price, depending on the location of the buyer. Delivery rates predictably increase based on distance. Sometimes the seller states the shipment’s origin, but if not, we can surmise it by finding the country with the least expensive delivery rate.

Figure 13: Premium USPS delivery method 

Figure 14: FedEx delivery method

Figure 15: USPS delivery method

Delivery terms and return policies vary from seller to seller. For example, some sellers only offer refunds due to unforeseen circumstances, such as seizure by customs (Figure 16), while others provide rebates if deliveries take longer than promised.

Figure 16: Refund policy description

Figure 17: Terms and conditions example


The circulation of counterfeit notes can impact businesses, individuals, and economies as a whole. Counterfeiters continuously leverage new technologies to incorporate new currency designs and security features, according to the leading global money laundering and terror financing watchdog, the Financial Action Task Force (FATF).

Despite the rise of digital currencies, the large volume of posts advertising counterfeit currency on the underground indicates the enduring relevance of cash. Unfortunately, the ultimate victims of money counterfeiting operations are the stores, local businesses, and individuals who accept cash payments.

Learn More

You may also like

Analyst looking at multiple monitors

July 11, 2024

Chinese APT40 Hackers Hijack SOHO Routers: Unleashing Cyber Espionage Attacks

Read more
Abstract digital landscape with flowing lines of glowing binary code in blue and orange, representing data streams and modern technology.

July 08, 2024

CVE-204-6387 Poses Risk to Organizations Relying on OpenSSH’s Server (sshd)

Read more
Black Hat Recap-Thumbnail

June 25, 2024

Third-Party Threat Intel and the importance of deep, dark web threat intelligence

Read more