Fraudsters are selling access to GPT-4, Claude, and other frontier AI models at one-tenth the market price. Matt Lenhard's writeup at Vectoral breaks down the exact mechanics: stolen API tokens, aggregated through relay APIs, resold as legitimate access. The operation is automated, scalable, and profitable precisely because AI providers struggle to detect and attribute the abuse before significant damage is done.
The sourcing methods are layered. At the low end: farm new accounts for free credits, drain them, repeat. Step up: sign up on pay-later terms with a stolen or temporary card, consume maximum tokens, then chargeback or default. Beyond that, fraudsters reverse-engineer consumer AI apps and hijack underprivileged support chatbots to route their own traffic through someone else's API budget. No single method yields much before triggering flags, but automated systems running all of them simultaneously at scale changes the math entirely.
Lenhard's mitigation argument is worth reading in full because it reframes the problem as a cost equation rather than a detection problem. Fraudsters operate on near-zero token acquisition cost. Anything that raises friction, even marginally, shifts that equation and pushes them toward softer targets. The original piece details specific friction mechanisms, and the comparison to AI-powered scambaiter tools is not decorative. It points directly at the only lever defenders actually control.
[READ ORIGINAL →]