Underground market for KYC bypass services: forged IDs, deepfakes and 'human KYC' sold with post-sale support
Flare research, published as sponsored content, describes how underground forums package services that defeat Know Your Client (KYC) identity checks. Offerings include forged identity and financial documents, manipulated photos and AI-generated videos, live deepfake tools, and accounts advertised as already verified. The article cites the February 2026 guilty plea of the OnlyFake operator in the US, whose service generated more than 10,000 fraudulent ID documents that were used to evade bank and cryptocurrency exchange checks and to launder money. Flare observed activity between March and September 2026 and says it collects hundreds of thousands of KYC-related search results each year.
Technical Details
- Sellers offer full KYC packages tailored to a platform's requirements, including bank statements and proof of address, with consistent names, photos and addresses to avoid rejection.
- To bypass passive and active liveness checks, actors advertise altered photos, AI-generated video built from the face on the ID document, and tools that replace the physical camera feed with altered footage in real time.
- 'Human KYC' services use a person to complete facial or video verification with prepared identity material. One recruitment post sought someone to use deepfake tools to appear as the person named in the documents. Another advertised guidance for live number-reading checks.
- Sellers also provide post-sale verification and account-recovery help, which keeps buyers dependent on them.
- Device and browser preparation is used to make the session look like a legitimate customer's.
Remediation
- Follow FinCEN's alert and review the whole application, looking for inconsistencies between identity data, supporting records, facial images and account activity.
- Follow NIST guidance: capture documents and facial images directly during the session, check for alteration, and detect software that injects or replaces camera footage.
- Use unpredictable liveness challenges (random movements, changing numbers) and device telemetry to spot non-standard customer equipment.
- Monitor criminal forums for exposed identities, credentials and active sessions, and invalidate exposed access.
Linha do tempo
-
Underground market for KYC bypass services: forged IDs, deepfakes and 'human KYC' sold with post-sale support
ler a análise desta fonte ocultar
Flare research, published as sponsored content, describes how underground forums package services that defeat Know Your Client (KYC) identity checks. Offerings include forged identity and financial documents, manipulated photos and AI-generated videos, live deepfake tools, and accounts advertised as already verified. The article cites the February 2026 guilty plea of the OnlyFake operator in the US, whose service generated more than 10,000 fraudulent ID documents that were used to evade bank and cryptocurrency exchange checks and to launder money. Flare observed activity between March and September 2026 and says it collects hundreds of thousands of KYC-related search results each year.
Technical Details
- Sellers offer full KYC packages tailored to a platform's requirements, including bank statements and proof of address, with consistent names, photos and addresses to avoid rejection.
- To bypass passive and active liveness checks, actors advertise altered photos, AI-generated video built from the face on the ID document, and tools that replace the physical camera feed with altered footage in real time.
- 'Human KYC' services use a person to complete facial or video verification with prepared identity material. One recruitment post sought someone to use deepfake tools to appear as the person named in the documents. Another advertised guidance for live number-reading checks.
- Sellers also provide post-sale verification and account-recovery help, which keeps buyers dependent on them.
- Device and browser preparation is used to make the session look like a legitimate customer's.
Remediation
- Follow FinCEN's alert and review the whole application, looking for inconsistencies between identity data, supporting records, facial images and account activity.
- Follow NIST guidance: capture documents and facial images directly during the session, check for alteration, and detect software that injects or replaces camera footage.
- Use unpredictable liveness challenges (random movements, changing numbers) and device telemetry to spot non-standard customer equipment.
- Monitor criminal forums for exposed identities, credentials and active sessions, and invalidate exposed access.