A groundbreaking service that utilizes artificial intelligence (AI) “neural networks” and “generators” to produce counterfeit driver licenses and passports has reportedly managed to successfully pass Know Your Customer (KYC) checks on multiple cryptocurrency exchanges. And the best part? It only costs $15 per document.
Known as OnlyFake, the website is capable of generating highly realistic fake driver’s licenses and passports from 26 countries, including major nations like the United States, Canada, the United Kingdom, Australia, and several European Union member states. To make matters worse, OnlyFake accepts payment in various cryptocurrencies through Coinbase’s commercial payments service.
According to a report by 404 Media on February 5, the website was able to circumvent the KYC verification process of the OKX crypto exchange using a photo of a counterfeit British passport generated by OnlyFake. The image of the forged passport was cleverly placed on a bedsheet, giving the impression that it was a genuine photograph.
Furthermore, a Telegram channel discovered by Cointelegraph revealed that OnlyFake users were sharing their apparent success stories in using these counterfeit IDs to bypass verification on multiple crypto exchanges and financial service providers, including Kraken, Bybit, Bitget, Huobi, and PayPal.
This service could potentially be a goldmine for crypto scammers and hackers, as it allows them to utilize fake documents to open exchanges and bank accounts, effectively shielding their true identities and making it significantly more challenging to track them down.
OnlyFake’s owner, who goes by the pseudonym “John Wick,” claimed to 404 Media that the counterfeit IDs could bypass KYC checks on exchanges like Binance, Kraken, Bybit, Huobi, Coinbase, OKX, and even the crypto-accepting neobank Revolut.
When approached for comment, an OKX spokesperson denied any involvement in or support for fraudulent activities and stated that they are actively investigating the report with their teams and external partners. They emphasized their commitment to combating fraudulent conduct and maintaining high compliance standards. According to a spokesperson from Revolut, the company has robust internal and third-party controls in place to mitigate the risk of AI and deep fakes being used in their KYC processes. Kraken also assured that they have stringent KYC and fraud checks to prevent the use of fabricated identification documents.
It’s worth noting that OnlyFake’s website claims that it does not produce forged documents, as doing so would be illegal. Instead, they state that their templates are intended for use in movies, TV shows, and web illustrations.
Generating a fake document on OnlyFake reportedly takes less than a minute. Users can upload their own photo or select one randomly from a personal library. The associated Telegram channel features numerous examples of counterfeit driver’s licenses and passports displayed on kitchen countertops, bedsheets, carpets, and desktops, mimicking the way they would be photographed for online verification.
The Telegram post also reveals that up to 100 fake IDs can be generated at once using data from an Excel spreadsheet.
Additionally, OnlyFake offers image metadata spoofing, allowing users to forge GPS location, date, time, and device information, as some identity verification services rely on these details to determine authenticity.
Crypto hackers and scammers have long employed methods to deceive identity verification systems and gain access to crypto exchanges while concealing their true identities. In late 2022, CertiK, a blockchain security firm, uncovered an online black market where individuals were selling their identities for as little as $8. These individuals would act as the verified faces of fraudulent crypto projects, opening bank and exchange accounts on behalf of malicious actors.
The widespread availability of AI deep fake tools has raised concerns among industry executives regarding the effectiveness of video verification in identity checks. Binance’s chief security officer, Jimmy Su, warned in May 2023 that scammers were increasingly attempting to deceive exchange KYC checks using deep fakes, and he predicted that these videos would soon be convincing enough to deceive human operators.
Cointelegraph reached out to Coinbase for comment on the use of their commerce product by OnlyFake but did not receive an immediate response. Binance, Bybit, Bitget, Huobi, and PayPal similarly did not respond when contacted for comment on the claims made by users who allegedly circumvented their identity checks.
In conclusion, the emergence of OnlyFake and its AI-generated counterfeit IDs poses a significant threat to the security and integrity of cryptocurrency exchanges and financial service providers. The ability to bypass KYC checks using these fake documents not only enables fraudulent activities but also hampers efforts to track down and hold scammers accountable. It is crucial for exchanges and regulators to address this issue promptly and implement robust measures to combat AI-driven fraud.