RT Article T1 Discerning novel value chains in financial malware JF European journal on criminal policy and research VO 23 IS 4 SP 575 OP 594 A1 Wegberg, R.S. van A2 Klievink, Bram A2 Eeten, Michel J. G. van 1970- LA English YR 2017 UL https://krimdok.uni-tuebingen.de/Record/1567226973 AB Fraud with online payment services is an ongoing problem, with significant financial-economic and societal impact. One of the main modus operandi is financial malware that compromises consumer and corporate devices, thereby potentially undermining the security of critical financial systems. Recent research into the underground economy has shown that cybercriminals are organised around highly specialised tasks, such as pay-per-install markets for infected machines, malware-as-a-service and money mule recruitment. Setting up a successful financial malware scheme requires the aligning of many moving parts. Analysing how cybercrime groups acquire, combine and align these parts into value chains can greatly benefit from existing insights into the economics of online crime. Using transaction cost economics, this paper illustrates the business model behind financial malware and presents three novel value chains therein. For this purpose, we use a conceptual synthesis of the state-of-the-art of the literature on financial malware, underground markets and (cyber)crime economics, as well as today’s banking practice. K1 Cybercrime K1 Financial malware K1 Transaction cost economics K1 Value chain K1 Underground markets K1 Vertical integration K1 Cyberkriminalität K1 Wertkette K1 Cyberuntergrund DO 10.1007/s10610-017-9336-3