- The US Justice Department says OnlyFake produced at least about 10,000 fake ID images; its operator pleaded guilty. Flare reports underground sellers now also offer deepfake video and live verification help.
- Flare's findings come from its own monitoring of criminal forums, and the tools it describes are advertised claims.
- Leaders should ask their identity-check vendor what happens when the document, the face and the session each look genuine but are not.
An identity check is a stack of evidence
When a bank asks a new customer to prove who they are, it asks for several things at once. A document. A face. Working contact details. A session that looks like any normal customer's.
Recent reporting points to a shift. Each of those layers can be bought on its own, and sellers also offer them as a bundle.
What the Justice Department says happened
Federal prosecutors in the Southern District of New York say Yurii Nazarenko, 27, of Ukraine, pleaded guilty to one conspiracy count. The charge covers fraud involving identification documents. Prosecutors say he ran OnlyFake, a website that sold fake photos of IDs.
Customers could generate driver's licenses for all fifty states. They could also make U.S. passports, passport cards and Social Security cards. Passports for about 56 other countries were on offer too.
Buyers chose the look of each image. It could pass as a flat scan, or as a photo of an ID lying on a table.
Customers paid in cryptocurrency. Bulk packages ran to as many as 1,000 IDs. The Justice Department says OnlyFake took in at least hundreds of thousands of dollars from about 2021 through 2024. It says the site was used to make at least about 10,000 fake IDs.
Nazarenko agreed to forfeit $1.2 million. The charge carries a maximum of 15 years in prison. The Justice Department also says he was extradited from Romania in September 2025.
BleepingComputer reports the plea came in February 2026. The Justice Department release set sentencing for June 26, 2026. The sources reviewed here do not report the outcome.
Why a photo of a document was enough
Banks and cryptocurrency exchanges run Know Your Customer (KYC) programs. These confirm who is opening an account and help stop money laundering.
The Justice Department says many institutions accept a scan or photo of a government ID. A fake image can pass as that proof. Prosecutors say OnlyFake's output let buyers get around these checks.
BleepingComputer, drawing on Flare, says the depth of checks depends on risk. A firm may validate the document and compare its photo with a live image. It may confirm contact details, ask where the money comes from, and screen against sanctions lists. Checks go on after opening, through transaction monitoring.
The bundle behind the forged document
Flare's platform monitors criminal forums. Flare says it collects hundreds of thousands of search results a year on KYC services and verified accounts.
It describes five parts of a typical fraud:
Identity data. Documents. Photos or video. Device and browser preparation. Live verification.
In March 2026, Flare saw a forum seller offering documents made to fit individual verification requests. These included bank statements, which platforms may use to confirm an address, income or account ownership.
Every name, photo and address has to agree across the file. If not, the platform may reject it or look closer. That is why sellers favor full packages over single files.
Then comes the face check. One kind, called passive liveness, studies a short camera clip for signs that a real person is there. Other checks ask the applicant to turn their head, blink, speak or read numbers aloud.
Flare says sellers advertise altered photos and AI-generated video built from the face on the ID. Some tools claim to change an operator's appearance during a live session. Flare also saw accounts advertised as having already passed identity checks.
Two caveats apply. These are sales pitches, and the material reviewed does not say how often they work. Flare also runs its own monitoring platform, so its view comes from its own collection.
The shift: the document was the easy part
This is WebPulse's interpretation. OnlyFake's volume suggests forged document images were easy to buy at scale. The harder question was always whether a real, present person stood behind the document.
If sellers now advertise synthetic video aimed at that step, one more layer moves from proof to claim. That is where AI multiplies the risk.
The cost lands on compliance teams and fraud analysts. They have to treat each check as one signal, not a verdict.
Questions to put to your team
Ask your identity vendor what it does when the document, the face and the session each look genuine. Ask whether it can tell a live camera feed from injected or generated video. Ask how it tests its liveness checks, and how recently.
Ask what happens after onboarding. The sources note that KYC continues through monitoring and extra checks when details change. An account that passed on day one deserves the same scrutiny as one that failed.
Finally, ask who owns the gap between fraud losses and compliance failures. Fake identities cross both.
A check that inspects one image can be beaten by buying one image. The defense has to look at the whole stack.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: U.S. Department of Justice, Southern District of New York.
