How Criminals Use Fake IDs, Deepfakes, and Human Operators to Bypass KYC Checks

Criminals are combining fraudulent identity documents, manipulated media, and live human assistance to bypass Know Your Customer (KYC) checks at banks, cryptocurrency exchanges, and other online services.

In February 2026, the operators of OnlyFake pleaded guilty in the United States for their role in a service that generated more than 10,000 fraudulent digital identity documents. Customers could create passports, driver’s licenses, Social Security cards, and documents from dozens of countries, displaying them as scans or photographs of physical IDs.

According to the U.S. Department of Justice, the documents helped cybercriminals conceal their identities, bypass identification checks at banks and cryptocurrency exchanges, and launder money.

The threat extends beyond forged documents. In underground communities monitored by Flare, attackers advertise manipulated photos and videos, live identity-verification assistance, and accounts they claim have already passed background checks.

Flare collects hundreds of thousands of search results each year related to KYC services and verified-account transactions. Activity observed from March through September 2026 shows how these services are packaged and promoted in underground markets.

What is KYC?

Know Your Customer, or KYC, is the process financial institutions use to establish a customer’s identity and assess the risk of providing services to that person.

Depending on the risk level, an organization may verify identity documents, compare document photos with live images, confirm contact information, request details about the source of funds, and screen customers against sanctions or politically exposed persons lists.

KYC does not end when an account is opened. Organizations continue monitoring transactions and may request additional verification when customer information changes or activity appears unusual. The Financial Action Task Force explains that customer due diligence involves identifying customers, understanding the purpose of the relationship, and monitoring it over time.

How KYC identity fraud works

Underground sellers combine several elements to create an identity package that can be used during KYC verification:

1. Identity data: Establishes the applicant’s claimed identity.

2. Identity documents: Provide evidence of the applicant’s personal details.

3. Photos or video: Link the claimed identity to a face.

4. Device and browser preparation: Makes the application session appear consistent with that of a legitimate customer.

5. Live verification: Uses human operators or synthetic media to attempt to complete the check.

Criminals build complete identity packages

In March 2026, Flare observed forum sellers providing identity information and financial documents generated or compiled for individual verification requests. These materials included bank statements and other records that platforms could use to verify an applicant’s address, income, or account ownership.

Complete KYC packages allow sellers to adapt documents to the requirements of a specific platform or customer. Names, photographs, addresses, and other details must remain consistent throughout an application because discrepancies can result in rejection or further review.

The resulting identity package can then be used during facial recognition or live authentication.

How criminals try to bypass live identity checks

Many KYC systems compare the photograph on an identity document with a live image of the applicant. Some systems use passive liveness checks, analyzing short camera recordings for signs that the subject is a real person. Others use active checks that ask applicants to turn their heads, speak, blink, or read numbers displayed on a screen.

To circumvent these checks, threat actors promote altered photographs and AI-generated videos based on the faces shown on identity documents. Some tools claim to change an operator’s appearance during a live session by replacing physical camera footage with altered video that follows instructions in real time.

Flare also observed advertisements for “human KYC” services. These services use identification documents supplied for an application to complete facial or video verification on behalf of the customer.

In one job posting, an actor sought someone who could use a deepfake tool to change their camera image during a live check and appear as the person named on the identity document.

In another example, Flare researchers observed threat actors promoting guidance for live number-reading checks. Because the applicant must respond to content presented during the session, the advertised bypass requires adjustment and adaptation rather than submission of a prepared recording or image.

Support continues after an account is delivered

Flare researchers observed merchants offering ongoing authentication and account-recovery support after delivering a completed account. The recruitment post referenced above also included support if a platform required another identity verification after the account was handed over.

If a later check requires the identity or participant used during registration, the buyer may remain dependent on the seller. This extends the KYC service beyond the initial sale and helps maintain the appearance that the authenticated customer remains in control of the account.

How organizations can detect KYC fraud

FinCEN has warned financial institutions that criminals are using deepfakes and fraudulent identities to circumvent KYC controls.

The alert recommends examining the entire application. Differences between the applicant’s identity, supporting records, facial images, and account activity may indicate that different people or tools created parts of the application.

NIST recommends detecting software that directly collects identity documents and facial images during verification sessions, checking whether those materials have been altered, and identifying systems that replace physical camera footage.

Unpredictable instructions, such as asking applicants to perform specific movements or read changing numbers, can make prepared recordings more difficult to use. Device information can also help determine whether a session is coming from equipment normally associated with the legitimate customer.

When applied together, these controls can improve an organization’s ability to detect combinations of fraudulent documents, deepfakes, and human operators promoted in underground KYC advertisements.

Flare gives organizations greater visibility into criminal forums, stolen credentials, active login sessions, identity theft, and threats related to their organizations. Security teams can use these alerts to identify affected accounts, disable exposed access, and investigate identity-related activity before it escalates into account takeover or further fraud.

Sign up for a free trial to learn more.

Sponsored and written by Flare.