Verafin's new dark-web feed hands investigators ten days before the check comes back

A queue is a scheduling problem before it is a detection problem, and Q6's own tally sets the scale: 1.2 million compromised checks, 57 million unique credentials and 158 million payment cards over eighteen months ^[4] comes to 216.2 million findings ^[14], roughly 395,000 a day ^[15], and divided evenly across the 2,800-plus members of Verafin's consortium ^[5] that is about 141 items per institution per day ^[16]. Even division is the wrong model, obviously, since a member holding the consortium average of about $4.6bn in assets ^[17] and roughly 304,000 counterparties ^[18] will match only a thin slice of any day's haul. The useful point is that the matching layer, not the collection, decides how much of this ever reaches a human.

That is the mechanism worth watching, or rather the more interesting version of it. An AML alert normally arrives bolted to a transaction, which hands the investigator both a trigger and an exit: clear it or escalate it. A validated dark-web listing arrives with neither. What Verafin describes doing with the lead time (flag accounts, tighten controls, warn customers ^[20]) is not investigation so much as servicing, and servicing gets paid for in reissued cards and outbound calls. Ten days ^[7] is the whole budget for that work, and because the companies say intelligence reaches investigators within minutes to hours of a listing appearing ^[10], almost all of the window survives the plumbing.

Check fraud is the sensible wedge typology, since Verafin's own 2026 report puts its growth at a 20.4 per cent annualized rate over two years ^[6], which compounds to about 45 per cent cumulatively ^[19], and a returned item is one of the few fraud events where the instrument is physically in transit long enough for ten days to be actionable.

The most likely outcomes split three ways. The signals could arrive as their own high-risk alerts inside the fraud and AML workflow ^[3], in which case the queue genuinely acquires a pre-transaction lane with its own staffing and its own metrics; they could arrive as enrichment fields on transaction alerts that were already firing, in which case what is being sold is a better-sourced risk score, precisely the thing Eli Dominitz says Q6 does not sell ^[12]; or the match rate could run high enough that servicing cost outruns avoided loss and clients quietly throttle the feed. My read, and it may be wrong, is that the second is the base case for year one and the first is the two-year product, because the enrichment path needs no new headcount and the standalone path needs a new job description.

The falsifier is narrow and named. Ten days ^[7] comes from a proof-of-concept average, and the reported announcement carries no pricing, no adoption count and no avoided-loss figure ^[21] to confirm it survives contact with production volume. Note also what Verafin declined to fund: a decade of proprietary source-building of the kind Dominitz describes ^[12], spending instead on the counterparty graph it already owns. Until someone publishes an action rate, 216.2 million findings ^[14] measures supply; it says nothing yet about value.