Template farms: A term fraud experts should know in 2025

Behind every fake document is a file.

And behind every file, there’s a source… An origin story.

That story often revolves around an editable and cheap document fraud template.

We call the suppliers of these templates “template farms:” a commercial-scale specialized online repository where forgeries are born, packaged, and distributed.

Think of them as the warehouses of the document fraud world. Instead of shipping goods, they deliver downloadable deception. They hold thousands of editable templates that power identity theft, synthetic fraud, and financial scams across the globe.

Template farms have evolved from niche forums into full-fledged businesses. Today, they blend sleek SEO-optimized storefronts, crypto-powered payments and Telegram automation to meet the needs of a growing market of fraudsters.

If you're trying to understand how mass document fraud works, you need to understand template farms first. Let’s do this.

Defining a template farm

A template farm is a centralized online platform usually a website, a Telegram channel, or a web forum thread) that specializes in the selling of editable document templates, with focus on non-generic, issuer-specific documents.

These templates mimic real-world documents like bank statements, utility bills, tax returns, pay slips, business licenses, invoices, certificates of incorporation, and many more. With minimal effort, users can customize these templates to fake official documents.

Today’s template farms function like SaaS platforms: searchable databases, low-cost pricing, localized templates, and even support desks. Most are organized by country, document type, or issuing institution. A fraudster looking for a "Wells Fargo account statement PDF" can find it in seconds.

More than just a product repository, a template farm is a foundational layer in the fraud economy. It's where synthetic identities get their paperwork. It's where shell companies buy legitimacy. And it’s where forgery becomes scalable.

Types of template farms 

We have already identified over 150 different template farms, dividing them into three main types. These are the online shop, the generator, and the messenger:

The online shop 

The most prevailing template farm type we have seen so far. An indexed (and often search-engine optimized) standard-looking website, utilizing widely-available e-commerce plugins like WooCommerce. 

They’ll have a product grid, category or country filter, standard add-to-cart ordering motion. The scary part? These types of farms are typically very easy to set up and maintain once you have your catalog of templates, meaning you can replicate or back up your farms virtually indefinitely and infinitely. 

As we like to keep reminding people, template farms are unkillable, and it‘s especially true for the “online shop” farm type.

This video shows how "online shop" template farms work and how easy they are to use.

The generator

This is the type of template farm that’s been making waves in the last year and a half, most notably thanks to the widely-known fake document seller “OnlyFake.” 

WIth this one, the process of obtaining a template and tailoring it to your needs is flipped – you need to supply the desired personal information within the farm’s UI, which then “generates” the final product. 

This approach should technically be more costly for customers who want to produce numerous fake documents (i.e. you can’t just buy one template and reproduce it a hundred times over on your own). 

However, farmers know this and actively lower their per-unit pricing the more documents you process. Even worse, generator-type farms often allow batch generation, meaning that if you need a large volume of fake documents, you can simply upload a spreadsheet-like list of personal details and “generate” numerous fake documents simultaneously. 

It might cost more, but it saves organized, serial fraudsters a lot of time as opposed to editing each document individually.

This video shows how "generator" template farms work and how easy they are to use.

The messenger 

Messenger type template farms are a little more difficult to clearly define as they can take on various forms. 

Their key feature is that the customer never actually visits any website to order a template.The end-to-end ordering process is handled within communication forum threads, messaging channels or apps, with the Telegram-based, automated bots being the primary example. 

First, the template farm customer finds a channel where templates are advertised, with each product listing having a “buy now” or “order” button that opens a bot chat with an option menu. 

The customer proceeds to select and order the product, providing necessary information, and moves to payment, either via Telegram’s native payment API or an external crypto wallet. Once the bot confirms the order and provides its summary, the customer simply needs to receive and save their digital document fraud template

An example of a "messenger" type template farm.

Template farm limitations

While the “online shop” type of farm is most frequent, and technically the easiest one to set up, it often varies the most in terms of template quality.

The “generators” often provide high-quality templates, combined with the option of bulk generation, but are more scarce and often require registration or some form of a subscription to be utilized.

The “messenger” farms often work hand in hand with one of the other farm types as some sort of supplement or alternative, and have the advantage of real-time updates and communication with their potential or existing customers.

Core features of a template farm

Having established a very basic template farm, typology, it needs to be made clear that while these farm types are structurally different, they still share some common characteristics. Some core template farm features include:

Centralized inventory 

Farms host hundreds to thousands (sometimes tens of thousands) of templates across dozens of categories and countries. Some farms stay in the lower tens and focus on a specific document type or region, but altogether, each farm offers multiple templates, with potential extra service of tailored editing upon request.

Categorized search

Users can filter by document type (e.g., invoice, bill, certificate), issuing country, or specific issuer (e.g., HSBC, IRS). Standard “online shop” farms often contain the website search bar, the “messenger” farms forum threads or chats are searchable, some chat groups or servers (e.g. Discord) contain several sub-conversations (channels/threads) dedicated to specific use cases (ordering, feedback, support, discounts/vouchers etc.)

Plug-and-play usability 

Templates are editable in common tools like Acrobat, Word, Photoshop or Excel. Many come preloaded with dummy data and editable fields.

Regular refreshes

Issuer branding, tax logic, or formatting rules are updated regularly to match real-world changes. Farmers actively invite their customer base to provide new authentic documents in exchange for free templates or discounts.

User-friendly design 

Clean UX, document previews, chatbot support, and cryptocurrency checkout have replaced shady file dumps. These are professional operations, usually with dedicated communication channels, online support, tutorials and add-on extra editing services.

Affordable price

Regardless of the farm, the average template price across our database (including over 300k templates) is around $22. While we identified several instances of templates being sold for hundreds or even thousands of dollars, the price of most templates is cheap enough to tempt a wide pool of potential fraudsters.

Anonymity

Despite often claiming that their templates can only be used for “novelty purposes”, template farmers know very well what kind of business they’re in. And they logically protect their real identity. No “about us” pages, no “who we are” profiles. Just made-up names and avatars with pop-culture references.

Who uses template farms — and how?

Template farms cater to a range of actors — from amateurs to seasoned criminals:

• First-time fraudsters. Students, gig workers, or underbanked users looking to fake one document — maybe to rent an apartment or boost loan approval odds. They buy one template, fill it out, and move on.
• Repeat offenders. Serial identity fraudsters, account openers, or mule recruiters. They use farms regularly, often integrating templates into broader synthetic ID toolkits.
• Professional resellers. These are the middlemen. They buy templates in bulk, localize them, and sell them through new storefronts or Telegram channels. Some even rebrand templates with new logos or features.

Farms also support cross-platform automation. Some users build bots to fill in new names, addresses, and numbers — pumping out dozens of fake documents per hour. That level of throughput isn’t possible without templated infrastructure.

How our threat intelligence unit researches and analyzes template farms 

At Resistant AI, our threat intelligence unit exists to understand how fraud enablers and fraudsters operate — and template farms are central to that mission.

We identify, monitor, and analyze these farms, studying how they’re built, who runs them, and how their templates evolve.

In our investigations into OnlyFake, Doc Juicer, and Utility Bro, we’ve seen how these platforms operate: offering not just files, but entire service ecosystems for document fraud including online support, community building and knowledge sharing.

Besides the template catalogs themselves, our team looks into:

• History, hosting and infrastructure. Domains, registry info, payment options, mirrors, server moves, traffic…we analyze various technical aspects of farm websites to understand how the farm was set up, how it functions, how  popular it is, and the overall customer journey.
• Template farm lineage. We study how reused components of templates or farm websites reveal networks of related vendors, and identify larger organized groups (clusters) systematically running numerous farms or channels.
  
• Marketing and communication patterns. Template farmers optimize for search engines, provide discounts, and actively entice customers to interact and communicate. We identify highly relevant pieces of communication to learn how template selling is reflected in real-world fraud attacks.
• Document fraud telemetry. We match farm templates to real-world attack logs — proving their direct role in onboarding fraud, bypassed KYC verification, and many other financial crimes.

As any research and investigation focused team, we constantly reevaluate, analyse and further develop our intelligence gathering processes.

Threat intelligence stats on template farm activity

The scale and size of the document fraud template landscape isn’t just eye-opening, it’s industrial. As data gathering is a core part of our threat intel operations, here are some high-level stats based on our research and what these mean going forward

Template farm stats gathered by our Threat Intel Unit

150+ farms identified 

We’ve already identified and catalogued more than 150 template farms, including anything from small, specialized vendors focused on IDs or utility bills, all the way to large-scale, “wholesale” farmers offering tens of thousands of templates from virtually any country and any document type (including even document types you would not normally think of like death certificates).

Considering that we have, so far, focused our research on farms operating in English (a list that still very likely hasn’t been exhausted), it seems inevitable that the list of farms can only keep growing.

1M+ monthly unique visitors to all farms 

Template farms are not niche or hidden in the corners of the dark web. On the contrary, they’re meant to be easily findable (often with just a simple search engine query), employing standard marketing and SEO optimization techniques to improve their visibility. The result? 1M+ unique visitors on a monthly basis.

A large portion of the overall template-selling activity is also happening within messaging apps like Telegram (without the necessity of visiting farm websites), indicating the overall level of demand and activity is likely much higher.

130+ monitored Telegram channels

Similarly to our process for cataloguing and harvesting data concerning template farm websites, we also monitor and systematically gather data from the “messenger” type of farms.

These are not limited just to Telegram chats, channels and groups, although the platform seems to, so far, dominate this kind of activity from what we have seen. That being said, we’ve already identified 130+ relevant channels where fraudsters and template farmers communicate on a daily basis, exchanging requests or offerings, and actively sharing knowledge and experience.

Some even get their accounts "verified" on various platforms.

Average price: $26.04 

Cheap enough to attract amateurs, lucrative enough to sustain a fraud operation. At this price point, template farmers aren’t just selling files—they’re selling scale. Each sale finances better designs, broader template libraries, and even research into new document types worth targeting next.

This isn’t opportunistic side-hustling. Template creation is a business model. Farmers optimize price points to balance volume and profit, luring high-volume buyers who’ll return again and again. Bulk discounts, multi-document bundles, even loyalty incentives—all signs that template production is evolving into its own fraud-as-a-service economy.

The real payoff? Recurrence. As fraudsters launch more attacks, they return to the same farms. Some might even resell or slightly tweak templates to build their own micro-operations—turning one farmer’s toolkit into yet more derivative threats.

Key lessons on template farms

After being knee-deep in template farm research for months, there are several lessons we consider crucial when trying to understand farm activity on a broader level:

Template farming is a huge, inter-connected ecosystem

Having already identified over 150 farms with over 300k of templates, we’re afraid we might just be scratching the tip of the iceberg, as we’ve mostly, so far, focused on easily searchable sites operating in English. Whether we consider other languages or the less visible part of the global web, this list is sure to keep growing.

We have also discovered a level of interconnectedness between farms ( mutual communication channels, referring domains, or even shared IP addresses) that clearly illustrates the presence of larger, organized crime groups likely operating numerous farms simultaneously.

Template farms are unkillable

A question we keep being asked at presentations and webinars: “Are you in touch with law enforcement? How are these template farms being handled (or not) legally?” 

While we can’t comment on specific conversations, the main issue preventing template farms from being dealt with efficiently is their virtual unkillability.

Considering the global nature of today’s internet landscape, we frequently see farmers operating from a different region than where their anonymous sites are hosted. 

In that sense, template farmers can easily set up multiple websites, have backups on backups, and shift their marketplaces from domain to domain once it might come under any scrutiny (or be blacklisted).

Farmers use breached verifications as social proof

Nothing sells like a social proof of your product working as intended. We’ve seen template farmers repeatedly sharing “proofs” of their successful attacks on numerous platforms. 

Various sectors and industries are heavily represented, whether it's cryptocurrency exchanges, financial services, online marketplaces, content platforms, or even companies providing web hosting or data center services.

The fact that the “fraudster” community present on these forums and channels is willingly sharing information on breached verifications checks is crucial, as this mode of communication can fuel more and more attacks on the listed platforms.

Within OnlyFake’s communications, for example, such breaches are shared as proof of template quality, even happy customers share successes as a form of review.

Deeper  embedded in their community, referrals on successful document fraud attempts (pointing fraudsters to weak points) add yet another threat layer that we need to proactively monitor (and do so).

Just consider that a single breach is successful, highlighting a verification vulnerability that can be exploited repeatedly. Suddenly the entire wider fraudster community will be turned onto the weakness and a slew of fraud attempts will ensue.

Farmers target serial fraudster as ideal customers

While the average price of templates is as low as $20 across the board, there seems to be a strategic shift in terms of pricing for numerous template farmers. Rather than counting on a large number of single template orders, farmers are actively encouraging bulk purchases through batch generation of documents or the selling of template packages.

This pricing strategy implies that there is a significant demand for batch generation of documents, and first-party fraudsters looking for a single document to commit a simple, singular act of fraud, might be increasingly viewed as irrelevant by fraud enablers when compared to so-called serial fraudsters.

In short, the document fraud landscape is quickly shifting towards scalable organized crime activity that is a much more significant threat to businesses rather than hosts of small-time, first-party fraudsters.

Conclusion

Document fraud is constantly evolving.

Template farms are not the only factor significantly impacting behaviours and techniques of fraudsters, but they undoubtedly are one of the biggest world’s document fraud enablers.

Considering what we have learned about the template farm landscape so far, one thing is evident – these farms are not going away, and they will keep supplying the global fraud community with as many cheap templates as possible.

Stopping this threat then requires a structural approach.

Resistant AI’s document fraud detection software doesn’t read what a file says — it dissects how it was made. We detect layout reuse, cloning patterns, and anomalies invisible to the human eye.

We continuously see and research more templates, understanding how they evolve and how to stop them.

Want to see how fraudulent template detection works in action?

Scroll down to book a demo and learn how our AI can uncover even the most convincing forgeries — before they cost you.

Frequently asked questions (FAQ)

Hungry for more document fraud template content? Here are some of the most frequently asked questions about document template fraud from around the web.

Do template farms = industrialized document fraud? 

Organized crime groups don’t necessarily need to leverage template farms, but there’s a reasonable expectation that they do. Template farms make forgery faster, cheaper, and harder to detect — and their reach is only expanding. If you want to understand how synthetic identities, shell companies, and cross-border scams operate, start here.

Is using a template farm illegal?

Buying a document template from a template farm is not illegal by itself — but it can become illegal depending on how it’s used.

If you buy a template to commit fraud (e.g., forging income to get a loan), that’s a criminal offense. Document fraud, identity theft, and financial misrepresentation carry serious penalties in most jurisdictions — including jail time, especially if multiple people or systems are affected.

Even if you don’t personally use it but sell or distribute fake documents to others, you could be charged with conspiracy or aiding and abetting fraud. Possession alone may raise red flags if combined with other evidence (e.g., modified PDFs, fake metadata, intent to deceive). Law enforcement might consider it preparatory to committing fraud.

Some template farms label their products as “for novelty use only,” trying to sidestep liability. But courts often look past disclaimers if the templates are functionally indistinguishable from real documents and used in fraudulent contexts.

Who is running these template farms?

Template farms are typically run by specialized fraud networks and solo operators who treat document forgery as a scalable business. These actors often operate on widely available websites, web forums or messaging channels where they sell editable templates for documents like account statements, utility bills, business licenses and much more. 

Many farms are highly segmented—some focus exclusively on specific document types, regions, or institutions, while others offer broad catalogs with thousands of cloned formats.

Our threat intelligence team has been able to trace several vendors back to identifiable fraud rings, regional clusters, or repeat pseudonyms operating across platforms. Many sellers recycle digital fingerprints such as watermarking styles, metadata quirks, or payment channels that reveal shared infrastructure or operational overlap. 

Some farms are run by individuals with backgrounds in graphic design who’ve professionalized and semi-automated their services. Others are connected to broader networks involved in identity laundering or money laundering enablement.

That said, attribution is rarely straightforward or simple. These actors use layers of obfuscation (VPNs, aliases, specialized domain hosting services or crypto wallets) to shield their real identities.

By correlating document signatures, transaction behaviors, and platform activity, our team can link fake templates back to known fraud clusters. So, while we may not uncover a legal name, we often know exactly which ecosystem they belong to and how to detect the fakes they generate.

Are template farms operating within the dark web? How do they attract customers?

Template farms are not confined to the corners of the dark web. While high-end forgery networks might still use dark web forums and private channels (or Discord servers, for example), a growing number of template farms have moved into the open.

Many now use standard marketing tactics (like SEO-optimized websites, backlinking schemes, and keyword stuffing) to rank on search engines under terms like “proof of address template” or “editable paystub PDF.” Some even run blog content or fake reviews to boost credibility and domain authority.

This public-facing approach makes them surprisingly easy to find. A quick search can surface dozens of template vendors masquerading as “document generators” or “novelty templates,” often with clean UI, PayPal integration, and customer testimonials. 

What they’re selling may technically fall into a legal gray area, but the intent (helping users fabricate believable documents) is clear. This blend of visibility and deniability is part of what makes modern template farms so effective — and so dangerous.

Is there software to detect template farm documents?

Yes, there is, and you’re at the right address. Combining the power of our document fraud detection software with threat intelligence research, we can now detect and match if a submitted document originated from any of the farms we have been cataloguing.

This helps us understand how some groups, regions or document type submissions might lean on template farms for document fraud more than others. It also helps us anticipate which farms or templates are in high demand and further target our research efforts accordingly.