In February 2026, the operator of **OnlyFake** pleaded guilty in the United States for his involvement in a service that produced more than 10,000 fraudulent digital identity documents. Customers of this service could generate passports, driver's licenses, Social Security cards, and other documents from dozens of countries, choosing whether they appeared as a scan or a photograph of a physical ID. According to the **U.S. Department of Justice**, these fraudulent documents enabled cybercriminals to obscure their identities, circumvent identity checks at banks and cryptocurrency exchanges, and facilitate money laundering. Activity in underground communities, monitored by **Flare's** platform, extends beyond fabricated documents. Threat actors now advertise manipulated photographs and videos, offer assistance with live identity verification, and sell accounts that have already passed identity checks. Each year, **Flare** collects hundreds of thousands of search results related to Know Your Client (KYC) services and the trade in verified accounts. Observations between March and September 2026 reveal how these illicit offerings are packaged and promoted across underground markets. ## What is KYC? KYC is the process financial institutions use to establish a customer’s identity and assess the risk associated with providing them services. Depending on the risk level, institutions may validate documents, compare photographs with live images, confirm control of contact details, request information about the source of funds, and screen customers against sanctions and politically exposed person lists. KYC continues after account opening through transaction monitoring and additional verification when information changes or activity appears unusual. The **Financial Action Task Force** describes customer due diligence as identifying the customer, understanding the purpose of the relationship, and monitoring it over time. ## How KYC Identity Fraud Works The steps below illustrate how threat actors assemble the elements used in KYC identity fraud: 1. **Identity data** establishes the applicant’s claimed personal details. 2. **Documents** are presented to substantiate those details. 3. **Photographs or videos** associate the claimed identity with a face. 4. **Device and browser preparation** makes the application session appear consistent with a legitimate customer’s. 5. **Live verification** is attempted by a human operator or with synthetic media.  ## Building the Identity Package In March 2026, **Flare** observed a forum seller offering generated or edited identity and financial documents tailored to individual verification requests, including bank statements and other records platforms may use to confirm an applicant’s address, income, or account ownership. The availability of complete KYC packages demonstrates how sellers adapt various documents to the requirements of a specific platform or customer. Names, photographs, addresses, and other details must remain consistent across the application, as any mismatch can trigger rejection or further review. This meticulous preparation creates the identity package later used during the facial or live verification stage.  ## Bypassing Live Identity Checks Many KYC systems compare the photograph on an identity document with a live image of the applicant. Some employ passive liveness checks, which analyze a short camera recording for signs of a real person. Others use active checks that prompt the applicant to turn their head, speak, blink, or read numbers shown on screen. To bypass these checks, threat actors advertise altered photographs and AI-generated videos based on the face shown in the identity document. Some tools claim to change the operator’s appearance during a live session, allowing the false face to follow instructions in real-time by replacing the image from the physical camera with altered footage. **Flare** also observed advertisements for “human KYC,” where a person completes facial or video verification using identity material prepared for the application. In one recruitment post, a threat actor sought an individual capable of using deepfake tools to alter the camera image during a live check and appear as the person named in the identity documents.  In another instance, **Flare** researchers observed a threat actor offering guidance for a live number-reading check. Since the applicant must respond to content presented during the session, this bypass requires coordination and adaptation rather than the submission of a pre-prepared object. ## Support After Account Delivery **Flare** researchers noted that sellers offer continued verification and account-recovery assistance even after delivering a completed account. The aforementioned recruitment post included help for situations where a platform requested another identity check following account handoff. When a subsequent check requires the original identity material or participant used during enrollment, the buyer may remain dependent on the seller. This extends the original KYC service beyond the initial sale, helping to preserve the appearance that the verified customer still controls the account. ## Detecting KYC Abuse **FinCEN** has warned financial institutions that criminals are utilizing deepfakes and fraudulent identity documents to bypass customer verification controls. Their alert recommends examining the complete application, as discrepancies between the applicant’s identity information, supporting records, facial images, and account activity may reveal that various elements were prepared by different individuals or tools. **NIST** recommends collecting identity documents and facial images directly during the verification session, checking for alterations, and detecting software that replaces footage from a physical camera. Unpredictable instructions, such as asking an applicant to make a particular movement or read changing numbers, can make prepared recordings harder to use. Furthermore, gathering information about the device and browser used for the application can help detect anomalies indicating fraud.