Underground Sellers Are Packaging Full "KYC-Bypass Kits" for Buyers
Threat intelligence firm Flare has published research detailing an active underground economy built around defeating Know Your Client (KYC) identity verification — the process banks, cryptocurrency exchanges, and other regulated platforms use to confirm a customer's identity and assess fraud or money-laundering risk before opening an account. Drawing on hundreds of thousands of search results collected from underground forums and marketplaces between March and September 2026, Flare's analysis shows sellers no longer just peddling fake ID templates — they now offer complete, modular fraud kits combining forged identity documents, AI-generated deepfake videos for live verification, human "fixer" operators who complete liveness checks on a buyer's behalf, and outright sales of accounts that have already passed KYC at a target institution.
The research arrives months after a concrete example of the scale this market can reach: in February 2026, the operator of OnlyFake — a document-forgery service — pleaded guilty in the United States after building a platform that generated more than 10,000 fraudulent digital identity documents, including passports, driver's licenses, and Social Security cards from dozens of countries. According to the U.S. Department of Justice, buyers used those documents to conceal their identities and circumvent identity checks at banks and crypto exchanges, enabling downstream money laundering.
Research Overview
| Attribute | Value |
|---|---|
| Researcher | Flare (underground market intelligence platform) |
| Data Collection Window | March–September 2026 |
| Volume Analyzed | Hundreds of thousands of search results tied to KYC bypass and verified-account sales |
| Related Prosecuted Case | OnlyFake operator, guilty plea February 2026, 10,000+ fraudulent documents generated |
| Documents Forged (OnlyFake) | Passports, driver's licenses, Social Security cards, dozens of country templates |
| Core Offerings Identified | Forged documents, deepfake liveness-bypass video, human "fixer" verification, pre-verified account resale, ongoing account-recovery support |
| Target Sectors | Banks, cryptocurrency exchanges, fintech onboarding platforms |
| Guidance Cited | NIST (document/liveness detection), FinCEN (application-consistency review) |
How the Underground KYC-Bypass Market Operates
Assembling a matched identity package
Flare describes fraud operators building out a full set of linked fraud components rather than a single fake document. A typical package pairs personal data (a name, date of birth, and address used to establish the claimed identity) with supporting documents (forged or digitally edited IDs, and in more advanced offerings, fabricated bank statements or address-verification records), photos or videos linking a human face to that claimed identity, and a prepared device and browser fingerprint meant to make the application session look consistent with a legitimate, first-time customer rather than a repeat fraud attempt. Services like OnlyFake let buyers choose whether a forged document renders as a flatbed scan or as a photograph of a physical card — a detail aimed specifically at matching whatever document-capture method a target platform expects.
Deepfake video injection against liveness checks
Beyond static documents, Flare found sellers advertising AI-generated deepfake videos built from the photo on a forged or stolen identity document, along with software capable of replacing a live camera feed in real time during a verification session. This lets a fraudulent face respond to the randomized liveness prompts platforms use to defeat simple replay attacks — turning the head, blinking, or reading a sequence of numbers aloud — because the injected video is generated or driven live rather than pre-recorded. Flare highlighted one underground recruitment post in which an actor specifically sought a collaborator skilled in using deepfake tools to alter the camera image during a live check, so the manipulated feed would convincingly appear as the person named in the submitted identity documents.
Human "fixer" operators for live verification
Where synthetic media alone risks detection, sellers also offer "human KYC" services: a live operator completes the verification call or video session personally, using a buyer's prepared identity material, rather than relying on software to drive the deepfake. This hybrid approach — a real person physically present for a liveness check, holding or referencing someone else's identity documents — is harder for behavioral and deepfake-detection systems to flag than a purely synthetic feed, since the voice, movement, and reactions are genuinely human, just attached to the wrong identity.
Pre-verified accounts and ongoing support
Flare's monitoring also surfaced a secondary market entirely separate from document forgery: sellers advertising accounts that have already passed a platform's KYC check, ready for immediate use by a buyer who never has to go through verification at all. These listings commonly come bundled with ongoing support — sellers stay engaged after the sale to help buyers respond to subsequent re-verification requests or recover access if the account is flagged or locked, extending the usable lifespan of a single compromised or fraudulently opened account.
Techniques and offerings at a glance
| Offering | Technique | Purpose |
|---|---|---|
| Forged/edited documents | Template-based ID generation (OnlyFake-style), choice of scan vs. photo rendering | Pass document-upload verification |
| Fabricated supporting records | Edited bank statements, address-verification documents | Reinforce a false identity during manual or secondary review |
| Deepfake liveness video | AI-generated video from a document photo, real-time camera-feed replacement | Defeat active liveness prompts (head turns, blinks, number reading) |
| Human KYC operators | A live person conducts the verification call using prepared identity material | Bypass deepfake-detection tooling by using a genuine human presence |
| Device/browser fingerprint prep | Configuring session metadata to resemble a legitimate first-time applicant | Avoid fraud-risk scoring tied to device anomalies |
| Pre-verified account sales | Resale of accounts that already cleared KYC at the target institution | Skip verification entirely |
| Post-sale account support | Sellers assist with re-verification or account recovery after purchase | Extend the operational life of a fraudulently opened account |
Impact Assessment
| Impact Area | Description |
|---|---|
| Account Takeover & Fraud | Buyers gain verified access to banking and crypto platforms under false identities, enabling fraudulent transactions and theft |
| AML/Compliance Exposure | Institutions unknowingly onboard synthetic or fraudulent identities, undermining anti-money-laundering controls and regulatory reporting |
| Money Laundering | Verified fraudulent accounts, as cited in the OnlyFake prosecution, provide a direct channel to launder illicit funds through legitimate-looking financial rails |
| Erosion of Liveness Defenses | Real-time deepfake injection and human-operated verification both target the specific controls (liveness checks) institutions rely on as a "last line" against document fraud |
| Market Maturity & Scale | Hundreds of thousands of related search results over a six-month window indicate sustained demand rather than isolated incidents |
| Reputational & Regulatory Risk | Fintechs and exchanges that fail to catch these bypass techniques face regulatory scrutiny, fines, and loss of customer trust |
Recommendations
For fintech and KYC compliance teams
- Collect identity documents and facial images directly during the live verification session rather than accepting pre-captured uploads, per NIST guidance, to reduce the window for pre-fabricated deepfake substitution.
- Deploy detection tooling capable of identifying virtual camera or camera-replacement software on the device completing a verification session, not just the resulting video content.
- Use unpredictable, randomized live-verification prompts (varying phrases, gestures, or sequences) instead of fixed or predictable liveness challenges that scripted deepfake tools can anticipate.
- Cross-reference submitted identity information, supporting documents, facial images, and subsequent account activity for internal inconsistencies, as recommended by FinCEN, rather than evaluating each verification element in isolation.
- Incorporate device and browser fingerprinting into fraud-risk scoring to flag sessions engineered to mimic a "typical" legitimate applicant.
For security and fraud teams
- Monitor underground forums and marketplaces (directly or via a threat-intelligence platform) for mentions of your organization's name alongside KYC-bypass or "verified account" offerings.
- Treat a rise in successfully onboarded accounts that are quickly used for high-risk transactions as a potential signal of bypassed or human-assisted verification, not just post-onboarding fraud.
- Build incident response playbooks specifically for suspected deepfake-assisted onboarding, including rapid account freeze and re-verification workflows.
- Share indicators and tactics with industry information-sharing groups (ISACs) and law enforcement, given the cross-institution nature of resold verified accounts.
For platforms and exchanges
- Periodically re-verify high-risk or high-value accounts rather than treating KYC as a one-time gate at signup, since sellers explicitly offer support for passing re-verification.
- Layer liveness detection with behavioral and transactional anomaly monitoring so a successfully passed verification is not treated as a permanent trust signal.
- Educate onboarding and compliance staff on the existence of human-operated "fixer" verification, since these sessions can pass automated deepfake detection by virtue of using a real human.
Key Takeaways
- Underground sellers now offer modular KYC-bypass kits — forged documents, deepfake liveness video, human fixer operators, and pre-verified accounts — rather than isolated fake IDs.
- The OnlyFake case (guilty plea February 2026) shows the real-world scale of document forgery alone: over 10,000 fraudulent identity documents generated and used to bypass bank and crypto exchange checks.
- Deepfake video injection can defeat active liveness prompts by replacing a live camera feed in real time, driven by video generated from a victim's or forged document's photo.
- "Human KYC" services — a live operator completing verification with someone else's identity material — are specifically designed to evade automated deepfake-detection tooling.
- A parallel market sells accounts that already passed KYC, bundled with ongoing support to survive re-verification or account recovery, extending fraudulent access well beyond initial onboarding.
- Flare's data (hundreds of thousands of search results, March–September 2026) indicates this is a mature, sustained underground economy, not a niche or declining threat — defenses should combine session-time document checks, unpredictable liveness prompts, and cross-field consistency review per NIST and FinCEN guidance.