Underground Markets Sell Forged IDs and Deepfakes to Bypass KYC Checks
Cybercriminals are monetizing forged identity documents and deepfake verification services to help buyers circumvent financial institution security protocols.
Key points
- OnlyFake operator pleaded guilty in February 2026 for generating over 10,000 fraudulent digital identity documents.
- Underground sellers offer manipulated media, live verification assistance, and pre-verified accounts to bypass KYC checks.
- Flare monitors these markets, noting that actors package identity data, documents, and biometric media to pass checks.
The operator of the OnlyFake service pleaded guilty in the United States in February 2026 for generating more than 10,000 fraudulent digital identity documents. According to BleepingComputer, this admission highlights the scale of underground operations designed to help cybercriminals bypass Know Your Client (KYC) security checks used by financial institutions and cryptocurrency exchanges.
The U.S. Department of Justice stated that these fabricated documents allowed criminals to conceal their identities and launder money. Customers of the service could create passports, driver’s licenses, and Social Security cards from dozens of countries. They could also choose whether the final output appeared as a digital scan or a photograph of a physical ID card.
The Scope of Underground KYC Fraud
The illicit trade extends beyond static document forgery. In underground communities monitored by Flare, actors advertise manipulated photographs and videos to assist with live identity verification. Sellers also offer accounts that they claim have already successfully passed identity checks. Flare collects hundreds of thousands of search results related to KYC services and verified accounts annually, indicating widespread demand for these tools.
Activity observed between March and September 2026 shows how these offerings are packaged and promoted across criminal forums. Sellers combine various elements to create comprehensive fraudulent profiles. This includes identity data to establish personal details, forged documents to substantiate those claims, and photographs or videos to associate the identity with a specific face.
How KYC Verification Works
KYC is the process financial institutions use to establish a customer’s identity and assess the risk of providing services. Depending on the risk level, institutions may validate the document, compare its photograph with a live image, and confirm control of contact details. They may also request information about the source of funds and screen customers against sanctions and politically exposed person lists.
The Financial Action Task Force describes customer due diligence as identifying the customer, understanding the purpose of the relationship, and monitoring it over time. KYC continues after account opening through transaction monitoring. Additional verification occurs when information changes or activity appears unusual, aiming to detect fraud that may have slipped through initial checks.
What should you do?
Organizations should review their current identity verification workflows for vulnerabilities to synthetic media and forged documents. Security teams need to ensure that live verification steps are robust against deepfake videos and manipulated photographs. Monitoring for accounts that exhibit unusual activity patterns can help identify fraud that bypassed initial checks.
What to do and how to stay safe: KYC
- Review identity verification processes to ensure they can detect forged documents and synthetic media.
- Implement robust live verification steps that compare document photos with real-time biometric data.
- Monitor accounts for unusual activity patterns that may indicate fraudulent onboarding or money laundering.
- Screen customers against sanctions and politically exposed person lists as part of ongoing due diligence.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What types of documents can be forged in underground KYC markets?
Sellers offer passports, driver’s licenses, Social Security cards, and documents from dozens of countries, available as scans or photos.
How do criminals use these forged identities?
They use them to conceal identities, circumvent identity checks at banks and crypto exchanges, and launder money.
What is the role of the Financial Action Task Force in KYC?
The FATF describes customer due diligence as identifying the customer, understanding the relationship purpose, and monitoring it over time.
