Underground Market for KYC Services Facilitates Identity Fraud

OnlyFake Operator Pleads Guilty

In February 2026, the operator of OnlyFake pleaded guilty in the United States. This individual was responsible for a service that generated more than 10,000 fraudulent digital identity documents. Customers could create various documents, including passports, driver’s licenses, and Social Security cards, from dozens of countries, choosing between scan or photograph formats.

Impact on Cybercrime

The U.S. Department of Justice stated that these fraudulent documents allowed cybercriminals to conceal their identities. They used these fake IDs to circumvent identity checks at financial institutions like banks and cryptocurrency exchanges, facilitating money laundering activities.

Broader Underground Market Activity

Beyond fabricated documents, underground communities monitored by Flare's platform show actors advertising manipulated photographs and videos. These services also include assistance with live identity verification and the sale of accounts that have already passed identity checks. Flare collects hundreds of thousands of search results annually related to Know Your Client (KYC) services and the trade in verified accounts.

Understanding KYC and Fraud

Know Your Client (KYC) is the process financial institutions use to establish a customer’s identity and assess risk. This involves validating documents, comparing photographs, confirming contact details, and screening against sanctions lists. KYC continues post-account opening with transaction monitoring and additional verification for unusual activity. Underground sellers package forged documents, deepfakes, and live verification help to pass these identity checks.