In a concerning development, a new service called OnlyFake has emerged, offering AI-generated fake driver’s licenses and passports that claim to successfully pass Know Your Customer (KYC) verification checks on various crypto exchanges.
These counterfeit IDs are being sold for a mere $15 each, potentially providing crypto hackers and scammers with a new tool to evade identification and security measures.
AI counterfeit IDs enable KYC bypass
The service provided by OnlyFake utilizes artificial intelligence, specifically “neural networks” and “generators,” to create convincing counterfeit driver’s licenses and passports from 26 countries, including major nations such as the United States, Canada, the United Kingdom, Australia, and several European Union countries.
Astonishingly, this service accepts payment in multiple cryptocurrencies through Coinbase’s commercial payments platform.
A recent report by revealed that they were able to successfully bypass the KYC verification process of the crypto exchange OKX using a fake British passport generated by OnlyFake. The ID in question was displayed on a bedsheet, seemingly taken as a photograph, making it appear as a genuine document.
Moreover, a Telegram channel associated with OnlyFake users showcased their apparent success in using these fabricated IDs to circumvent verification procedures at various crypto exchanges and financial service providers, including Kraken, Bybit, Bitget, Huobi, and even PayPal.
A growing concern for security
The emergence of such services poses a significant risk within the crypto industry. Scammers and hackers could exploit these counterfeit documents to establish exchange accounts and bank accounts under false identities, concealing their true information and making it challenging for authorities to track and apprehend them.
The pseudonymous owner of OnlyFake, who goes by the alias “John Wick,” claimed that their fake IDs could also trick KYC checks at other major exchanges like Binance, Kraken, Bybit, Huobi, Coinbase, and OKX, as well as the crypto-accepting neobank Revolut.
It is worth noting that OnlyFake attempts to distance itself from illegal activities, asserting that it does not “manufacture forged documents” and that its “templates are only for use in movies, TV shows, and web illustrations.” Nevertheless, the ease with which these fake IDs can be generated and their apparent success in evading KYC checks raises serious concerns about their potential misuse.
Swift and simple fabrication
Generating a fake document on the OnlyFake website reportedly takes less than a minute. Users can upload their own photo or select one randomly from a “personal library of drops” without the involvement of a neural network. This streamlined process allows for the rapid production of counterfeit IDs.
Additionally, an associated Telegram channel has displayed numerous examples of fabricated driver’s licenses and passports, presented on various surfaces such as kitchen countertops, bedsheets, carpets, and desktops – mimicking how they might appear if used for online verification purposes. The post also suggests that up to 100 fake IDs can be generated simultaneously using Excel spreadsheet data.
Enhanced deception through metadata spoofing
To further enhance the deception, OnlyFake offers users the option to spoof image metadata, including GPS location, date, time, and the device used to capture the alleged photo. This capability is crucial, as some identity verification services rely on such data to establish the authenticity of documents.
The ability to manipulate these details adds an extra layer of complexity to efforts aimed at preventing fraudulent activity.
Ongoing concerns in the crypto industry
Crypto hackers and scammers have consistently utilized various methods to spoof information and gain access to crypto exchanges while maintaining their anonymity. In late 2022, blockchain security firm CertiK exposed an online black market where individuals were selling their identities for as little as $8, agreeing to act as the verified faces of fraudulent crypto projects and open bank and exchange accounts on behalf of malicious actors.
Furthermore, the widespread availability of AI deep fake tools has raised concerns among crypto industry executives regarding the effectiveness of video verification in some identity checks. These developments highlight the ever-evolving challenges faced by the crypto sector in maintaining robust security measures.
