Underground Sellers Offer Deepfakes and Support to Bypass KYC Checks
Summary
Flare reports that underground sellers advertise fake identity packages, altered images and videos, live verification help, and account-recovery support to bypass KYC checks. The article outlines detection measures recommended by FinCEN and NIST.
Key points
- Flare observed underground sellers offering identity and financial documents tailored to specific verification requests, with details designed to remain consistent across an application.
- Advertised methods to bypass facial checks include altered photographs, AI-generated videos, and changing a camera feed during a live session.
- Some services offer a human to complete verification, guidance for live number-reading checks, or ongoing help if an account requires re-verification.
- The article cites the U.S. Department of Justice’s account that the OnlyFake operator pleaded guilty in February 2026; the service generated more than 10,000 fraudulent digital identity documents.
- FinCEN recommends reviewing the full application for inconsistencies across identity details, supporting records, facial images, and account activity.
- NIST recommendations cited include capturing documents and facial images during verification, checking for alteration or camera-feed replacement, and using unpredictable instructions and device information.
Article Details
- Event Type
- Report on underground-market KYC identity-fraud services, including fraudulent identity documents, manipulated images and videos, live-verification assistance, and verified accounts.
- Impact
- These services can help cybercriminals bypass identity checks at financial institutions and cryptocurrency exchanges, conceal their identities, and launder money. They also create risks of account takeover and further fraud.