In the cybercrime ecosystem, trust is a foundational pillar for the smooth functioning of exchanges, even as these interactions rely on anonymity, the absence of legal recourse, and perpetual structural instability.
Buyers and sellers operate under pseudonyms, unaware of each other’s real identities, in an environment exposed to scams, exit scams, law enforcement crackdowns, and internal conflicts between actors. This situation makes building trustworthy relationships particularly challenging on the forums and marketplaces of the Deep and Dark Web.
Despite these constraints, the cybercriminal community has put in place mechanisms to frame transactions and curb abuses. These include restricting registrations, moderating content, reputation systems, the use of third parties (escrow), and the creation of genuine “courts” within the community to resolve disputes between members. These mechanisms play a central role in shaping exchanges and regulating fraudulent behavior.
An ecosystem structured around reputation and the roles of each participant
Before analyzing these tools, it is useful to recall the main actor profiles at play. Cybercriminal forums operate like markets where an offering (databases, access, malware, fraudulent services) meets a demand, with transactions typically conducted in cryptocurrencies or via internal credit systems.
These exchanges are overseen by admins and moderators who enforce the rules, as well as trusted members such as escrows, whose reputation is supposed to guarantee the safety of transactions. Reputation, embodied by factors such as account age, activity, peer evaluations, financial deposits, or the attainment of ranks, is a key element in establishing trust.
Fragility of trust and responses to instability
Yet, despite these safeguards, scams persist. The sale of falsified data, the resale of publicly leaked data, impersonation of known groups, fake escrows, or exit scams illustrate the multiple forms of fraud that undermine the ecosystem.
This distrust is amplified by the pressure from authorities, as evidenced by major international operations (Cronos, Endgame) that led to platform seizures and the arrest of administrators. These actions, by eroding the credibility of forums, have deeply strained trust among users of cybercrime forums.
Facing this instability, cybercriminals have had to implement safeguards: tightening access conditions, strengthening internal regulations, multiplying reputation checks, and partial migration to alternative platforms like Telegram. In this context, internal “courts” have become a central element to foster trust within the cybercriminal community.
DarkForums scam reports as a regulatory mechanism
It is within this frame that this article examines the scam-reporting system of DarkForums, a cybercrime forum that has grown rapidly since the dismantling of BreachForums.
A direct heir to the RaidForums and BreachForums mechanisms, this system allows a member to publicly report a dispute against another user.
From a qualitative and quantitative analysis of 61 scam reports published between December 2024 and November 2025, this study assesses the mechanism’s effectiveness and its role in building trust.
Results show that the majority of disputes concern scams related to non-fulfillment of transactions, followed by the sale of falsified data and the resale of public data. In nearly three-quarters of cases, administrators’ responses are limited to excluding the accused, refunds being rare due to the absence of a deposit system on DarkForums. Despite these limits, the transparency of tickets, their public archiving, the speed of processing, and the involvement of some users playing the role of “jurors” contribute to strengthening members’ ability to assess the reliability of their interlocutors.
The study also highlights abuses, notably the filing of malicious or weaponized complaints used for revenge or competition. These abuses remind us that the system remains imperfect and vulnerable to manipulation.
Nonetheless, despite these flaws, scam reports and the moderators’ role constitute an essential regulatory tool. They provide a minimal framework of control and visibility, enabling a level of trust that supports the ongoing exchange of data and illicit services within the cybercriminal ecosystem.
