Online Banking Access to a BNP Paribas Savings Account Offered for Sale
A forum actor posting as HollowCrimeCorp is selling what they describe as verified and active access to a high value BNP Paribas account, offered as a username and password pair rather than as data. The post claims full dashboard visibility and working transfer capability. The proof supplied is a screenshot of a workplace savings and retirement portal showing a total balance of roughly 262,000 euros, recent contribution entries and an amount available for withdrawal. Escrow is required and the price is by private negotiation. This is a single account rather than a dataset. The claim is unverified.
▣Listing details
!What the listing claims
- Full online banking access
- Username and password supplied
- Access described as verified
- Access described as active
- Dashboard visibility
- Transfer capability
- Workplace savings portal
- Balance of about 262,000 euros
- Retirement savings products
- Amount available to withdraw
- Recent contribution entries
- Single account offered
- Escrow mandatory
- Price by private message
- Group attribution claimed
- No acquisition method described
- No account holder named
- No further samples offered
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Initial access T1078 Valid accounts Stated What is being sold is a working credential pair for the account holder's own banking login, not a flaw in the bank.
- Credential access T1589.001 Gather victim credentials Inferred No acquisition route is given. Credentials offered this way usually originate from infostealer logs or phishing rather than from any compromise of the institution.
- Impact T1657 Financial theft Stated The advertised value is the ability to move money, with the visible balance used as the selling point.
⚠Potential impact
Unlike the database listings that dominate this market, the harm here is concentrated on one person, and it is severe for them: retirement savings are usually the largest sum an individual holds and the slowest to rebuild. Because the portal shown is a workplace scheme, an employer's plan administration may be touched as well, and the visibility on offer exposes contribution history and withdrawal eligibility, which supports follow on fraud even if no transfer succeeds. Worth stating plainly: nothing here indicates a compromise of the bank, only of one customer's credentials.
iStatus Unverified
A screenshot is the weakest form of proof in this particular market, since images circulate between sellers, are trivially edited, and demonstrate a session at one moment rather than access that still works. No acquisition method, date or account holder is given, and the words verified and active are sales language rather than evidence. The escrow requirement suggests the seller expects buyers to doubt them. Dark Web Informer has not tested the access and is not linking the contact address.
Dark Web Informer // Threat Intelligence
