UMVA can exclusively reveal that a sophisticated wire transfer scheme, originating in the United Arab Emirates, is routinely deceiving American financial institutions. What appears to be a standard commercial payment, routing through Europe before landing in the U.S., is in fact a masterclass in financial deception.
To compliance teams, it registers as a routine transaction from a legitimate company with impeccable filings and a verifiable beneficial owner. Nothing triggers a flag. Yet, UMVA has uncovered details revealing the true architect: the Iranian government, meticulously cloaked behind shell companies. The identity documents for these entities are chillingly fabricated from stolen Social Security numbers, acquired on clandestine dark web markets just weeks before a transaction.
UMVA's dedicated teams spend their days deep inside the shadowy fraud networks that enable such operations. We relentlessly monitor dark web markets, encrypted messaging channels, document forgery platforms, and the sprawling facilitator networks handling on-the-ground logistics. Iran, North Korea, Russia, and China are relentlessly working to breach American institutional defenses, and the machinery they employ is far more visible than many assume, if you know precisely where to look.
Every single one of these illicit operations begins in the same place: underground markets teeming with stolen identity components. Social Security numbers, dates of birth, address histories, account credentials – all harvested from massive data breaches, meticulously packaged, and priced by freshness and geographic origin. Russia stands as the primary supplier of this raw material, deploying sophisticated infostealer malware that silently captures every keystroke and stored file from a victim’s computer, funneling it to collection servers for sorting and resale.
One such marketplace, a Telegram channel known as "Karma Fullz," is run by Russian-speaking actors. It brazenly sells the identities of former legal immigrants to the United States, bundled with associated bank accounts and established credit histories. Buyers then exploit these comprehensive profiles to incorporate shell businesses and defraud financial institutions and government programs with chilling ease.
Another market, "South Park BA Logs," sells compromised U.S. bank account credentials, complete with session cookies, browser fingerprints, and linked email access. Between March 2023 and January 2026, UMVA's analysis identified 1,210 listings on that single channel alone, representing an estimated $152 million
