At this point, legitimate companies buying credential dumps from cybercriminals might be the biggest spenders on cybercrime forums. The number of separate services offering "personas" to go buy these dumps is getting out of hand.

I understand wanting to protect your customers but at what point are they further funding and encouraging the infostealer actors?