Hands-On with the CPN Economy, Part 2: How CPNs are Sold and Marketed

In Part 1 of this series, we explored what Credit Privacy Numbers (CPNs) are, how they function, and why they pose significant risks to both consumers and financial institutions. We explored how fraudsters leverage CPNs to create synthetic identities and build seemingly legitimate credit profiles that can be sold and used to secure everything from a cell phone plan to a credit card or rental apartment. 

In Part 2, we're diving deeper into the markets where these fraudulent identities are bought, sold and marketed.

How the CPN market operates

A CPN in isolation has little value. That's why once fabricated, they are often paired for sale with tradelines—accounts listed on a credit report that reflect an individual's credit history with lenders—in order to appear legitimate. These tradelines are tied to the identity of the primary account holder, who has the ability to add secondary users as authorized users. To enhance a CPN's credit profile, criminals add the CPN as an authorized user to existing tradelines they have access to. This tactic artificially boosts the CPN’s credit history, making it appear more established when banks and lenders review the identity’s credit profile.

Since this process is time-consuming, CPN vendors offer ready-made solutions to expedite it. These vendors operate on the open web, social media platforms, and encrypted messaging services like Telegram. To better understand the scope of this market, I conducted a market study comparing CPN vendors who operate through their own websites versus those who are active on platforms like Facebook in order to document their offerings, pricing structures, payment methods and overall activity.

Data collection 

I compiled a list of ten non-darkweb websites and ten Facebook groups that offered CPN packages for sale. I then gathered all available information from these sources and reached out to the website owners and Facebook group administrators for further details about their offerings. The collected data was systematically coded into an Excel spreadsheet, enabling a detailed comparison of the services provided by these vendors.

Websites' offerings 

All of the websites selling CPN packages present themselves as professional services, complete with customer support, promotional content and detailed product descriptions. 

Each website offered between 1 and 13 CPN packages, with an average of five packages per site. The packages varied based on credit limits and the age of the associated tradelines, which determined the overall credit strength of the profile.

Here's a breakdown of the most common packages:

• A Starter Package typically included a CPN with one tradeline that was at least two years old, a credit limit of $12,000+, and an average credit score of 685+. This package was designed for those looking to establish a basic credit history, and ranged from $180 to $740.
• The Mid-Level Package provided a CPN with two tradelines aged 1 to 3 years, offering a combined credit limit of $40,000+ and an average credit score of 730+. This package was aimed at individuals seeking a more robust credit profile, costing from $700 to $1,400.
• For those looking for the strongest possible credit history, the High-Level Package included a CPN with four tradelines aged 3 to 8 years, a combined credit limit of $95,000+, and an average credit score of 780+. These packages ranged from $1,200 to $2,500.

In addition to CPN packages, six of the websites also offered individual tradelines for sale, with the number of available tradelines per site ranging from 3 to 60, averaging 21 per website. Prices varied from $200 to $1,500, depending on the age and credit limit of the tradeline. Cheaper tradelines were typically newer and had lower credit limits, capped at $10,000, while more expensive tradelines were older and came with higher credit limits, reaching up to $100,000. The price differences reflect the value placed on credit history length and available credit, with older, higher-limit tradelines being more attractive to those looking to strengthen their credit profiles.

CPN packages available on a website

Authorized user tradelines available on a website

Auto tradelines were available on five of the websites, with each site offering between one and five tradelines. Prices for these tradelines ranged from $250 to $1,250, with the more expensive options typically providing higher credit limits.

Finally, four websites offered business tradelines for sale, with each site listing three to five tradelines. Prices for these tradelines started at $400 and went up to $5,900. The cheaper tradelines were generally newer and had lower credit limits, capped at $150,000. In contrast, higher-priced tradelines were older and came with significantly higher credit limits, sometimes exceeding $1 million.

Payment methods

Payments were primarily accepted through Bitcoin (BTC), CashApp, and Chime. Some websites also accepted debit and credit cards, as well as direct deposits to bank accounts. One vendor even accepted gift cards as payment.

Vendor activity & customer interaction

To evaluate vendor legitimacy, we engaged directly with both website operators and Facebook group admins. Of the ten sites we contacted, five were fully functional and actively offering services. One vendor stood out, frequently sending promotional emails and holiday sales offers (see below). He also followed up with us via text messages. To demonstrate the "legitimacy" of his services, he provided various forms of evidence. These included: 

• Customer testimonials: videos of satisfied buyers, screenshots of credit approvals, and approval emails from apartment rental offices and credit card companies.
• Social Security cards: images showing CPNs alongside customers' names, often with visible identification numbers.

Images shared by fraudsters as evidence that their CPN services work.

The second form of evidence included images of Social Security cards with the names and CPNs of previous customers. 

Images of fake Social Security cards with names and CPNs of customers 

Further assessment of the CPNs and names in these shared images revealed troubling patterns. One CPN is linked to a 29-year-old female from Ohio who primarily uses her own SSN when applying for credit lines and other financial services. Her first recorded use of a CPN occurred in August 2024 with a credit card company. However, our data indicates that she is associated with at least one additional CPN.

Another CPN was traced to a male in his mid-30s from Alaska. He began using his CPN in 2021 for applications with leasing and credit companies. While his CPN usage was high throughout 2021, data suggests that starting in 2022, he stopped using the CPN for financial service applications.

Facebook Groups: real-time interaction and fake documents

While websites provided a more structured, traditional shopping experience, Facebook groups offered a more dynamic interaction. Each group we investigated was managed by between one and five administrators, with the majority maintained by a single admin. The number of group members following these pages ranges from 36 to over 6,900, with an average of 2,893 followers per group.

In addition to CPN packages, most of these Facebook groups also offer fake documents for sale, including paystubs, check stubs, bank statements, and Social Security cards. Common posts on these pages feature images of fake documents, screenshots of credit reports displaying credit scores, and customer testimonials. 

Unlike websites, Facebook groups rarely posted detailed package descriptions or pricing. Instead, sellers encourage buyers to inquire directly via text or private message. When we contacted the group administrators, all 10 responded promptly, with one referring us to a website we hadn't previously encountered.

A CPN-selling Facebook group page 

CPN Packages offered on one of the CPN selling Facebook groups

Facebook sellers typically offered similar packages to those found on websites. The primary differences between these packages were based on credit limits, the age of the tradelines attached to the CPN, and the types of fake documents included with the CPN.

• A Starter Package typically included a CPN with one tradeline that was at least two years old, a credit limit of $12,000+, an average credit score of above 700, and between 2-3 paystubs. Costs were between $250 to $750.
• A Mid-Level Package provided a CPN with several tradelines, but no details about the age or credit limits of the tradelines. All the vendors promised was a credit score of 730+, bank stubs, and paystubs. Costs were between $650 and $950.
• High-Level Packages with stronger credit profiles and additional fake documents cost over $1,000.

Payment methods

Payments were similar to those of the websites, with the occasional addition of Venmo, Apple Pay and Google Pay.

Vendor activity & "proof" of legitimacy

To evaluate vendor legitimacy, we engaged directly with the admins of the Facebook groups and were able to confirm that all ten were fully functional and ready to provide the services listed. Only one vendor took more than a day to respond to our message. The other vendors were active, followed up with us via text messages and emails, and demonstrated the "legitimacy" of their services, providing testimony and other evidence from satisfied customers. This evidence was sometimes also shared directly in the sellers's groups. 

An example of the images vendors share to demonstrate that their services work

Behind the scenes: CPN business operators

One of the most revealing aspects of this investigation was uncovering the identity of a CPN website owner. To establish legitimacy, the CEO willingly shared background information about both himself and the company, allowing us to dig deeper. We discovered that the company's listed address, for example, appears to be an Earth Class Mail location. (Earth Class Mail allows business clients to maintain privacy by receiving their company's mail at any Earth Class Mail retail location. The mail is then digitized and made available online so the business owner does not have to visit the location in person). 

The CPN company owner's bio on his website.

The company's OpenCorporates profile with business address, and Google Streetview for the listed address.

Further analysis of the owner exposed a pattern of identity fraud. Consistent with the practices he promotes to his customers, the company owner appears to be using four additional SSNs alongside his original one. In 2019, he initially used his own personal information (PII) for financial activities. By 2021, he had shifted to using other SSNs to conduct financial transactions. 

In February 2023, he officially launched his CPN business, further expanding his fraudulent activity. However, in 2024, an interesting shift occurred as he returned to using his original SSN. The graph below illustrates the volume of applications submitted by the company owner to various organizations, primarily financial institutions, using both his real SSN and multiple CPNs. 

Applications made by the CPN company owner; each dot represents an application to a financial institution.

Conclusions 

My investigation into the markets on which CPN vendors operate through websites and Facebook groups highlights the scale and sophistication of this fraudulent industry. Vendors use a variety of tactics to establish credibility, including customer testimonials, fabricated and legitimate credit histories, and promotional content. Websites typically offer structured CPN packages with detailed credit-building options, while Facebook groups tend to include additional fraudulent documents, such as pay stubs and bank statements, in a more informal, interactive marketplace setting.

Pricing structures across both platforms suggest a well-developed market catering to individuals seeking alternative credit solutions. While websites offer more transparency regarding package details, Facebook groups provide direct and immediate communication, with sellers actively engaging potential buyers. The payment methods used—primarily Bitcoin, CashApp, and other untraceable options—reflect efforts to avoid detection.

Additionally, the investigation into a CPN business owner revealed a pattern of identity manipulation, reinforcing the fraudulent nature of the industry. The owner himself engaged in the practices he promoted, using multiple SSNs and CPNs over time. This underscores the inherent risks of engaging with such services, as they are often linked to identity theft and financial fraud.

Ultimately, the ease of access to CPNs through both dedicated websites and social media platforms demonstrates an urgent need for stronger enforcement measures. Law enforcement agencies, financial institutions, and social media platforms must collaborate to curb the proliferation of these fraudulent schemes and protect consumers from potential legal and financial consequences.

Missed part one of this CPN investigation? Read it here.