Inside the Underground Market for Know Your Client Services

In February 2026, the operator of OnlyFake pleaded guilty in the United States for his role in a service that generated more than 10,000 fraudulent digital identity documents. Customers could create passports, driver’s licenses, Social Security cards, and documents from dozens of countries, then choose whether each appeared as a scan or a photograph of a physical ID.

According to the U.S. Department of Justice, the documents allowed cybercriminals to conceal their identities, circumvent identity checks at banks and cryptocurrency exchanges, and launder money.

The activity extends beyond fabricated documents. In underground communities monitored by Flare's platform, actors advertise manipulated photographs and videos, assistance with live identity verification, and accounts they claim have already passed identity checks.

Each year, Flare collects hundreds of thousands of search results related to Know Your Client (KYC) services and the trade in verified accounts. Activity observed between March and September 2026 shows how these offerings are packaged and promoted across underground markets.

What is KYC?

It is the process that financial institutions use to establish a customer’s identity and assess the risk of providing services to them.

Depending on the level of risk, they may validate the document, compare its photograph with a live image, confirm control of contact details, request information about the source of funds, and screen the customer against sanctions and politically exposed person lists.

KYC continues after the account opening through transaction monitoring and additional verification when information changes or activity appears unusual. The Financial Action Task Force describes customer due diligence as identifying the customer, understanding the purpose of the relationship, and monitoring it over time. 

How KYC identity fraud works

The steps and image below illustrate how actors assemble the elements used in KYC identity fraud:

1. Identity data establishes the applicant’s claimed personal details.

2. Documents are presented to substantiate those details.

3. Photographs or videos associate the claimed identity with a face.

4. Device and browser preparation makes the application session appear consistent with a legitimate customer’s.

5. Live verification is attempted by a human operator or with synthetic media.

Building the identity package

In March 2026, Flare observed a forum seller offering generated or edited identity and financial documents tailored to individual verification requests, including bank statements and other records that platforms may use to confirm an applicant’s address, income, or account ownership.

The offer of complete KYC packages shows how sellers adapt several documents to the requirements of a particular platform or customer. Names, photographs, addresses, and other details must remain consistent across the application because a mismatch can trigger rejection or further review.

This preparation creates the identity package later used during the facial or live verification stage.

Bypassing live identity checks

Many KYC systems compare the photograph on an identity document with a live image of the applicant. Some use passive liveness checks, which analyze a short camera recording for signs of a real person. Others use active checks that ask the applicant to turn their head, speak, blink, or read numbers shown on screen.

To bypass these checks, actors advertise altered photographs and AI-generated videos based on the face shown in the identity document. Some tools claim to change the operator’s appearance during a live session, allowing the false face to follow instructions in real time by replacing the image coming from the physical camera with altered footage.

Flare also observed advertisements for “human KYC,” in which a person completes facial or video verification using identity material prepared for the application.

In one recruitment post, an actor sought someone who could use deepfake tools to alter the camera image during a live check and appear as the person named in the identity documents.

In another example, Flare researchers observed a threat actor advertising guidance for a live number-reading check. The applicant must respond to content presented during the session, thus the offered bypass requires coordination and adaptation rather than the submission of a prepared object. 

Support after the account is delivered

Flare researchers observed sellers offering continued verification and account-recovery assistance after delivering a completed account, and the recruitment post above included help when a platform requested another identity check following handoff.

When a later check requires the identity material or participant used during enrollment, the buyer may remain dependent on the seller, extending the original KYC service beyond the sale and helping preserve the appearance that the verified customer still controls the account.

Detecting KYC abuse

FinCEN has warned financial institutions that criminals are using deepfakes and fraudulent identity documents to bypass customer verification controls.

Its alert recommends examining the complete application because differences between the applicant’s identity information, supporting records, facial images, and account activity may reveal that several elements were prepared by different people or tools.

NIST recommends collecting identity documents and facial images directly during the verification session, checking whether they have been altered, and detecting software that replaces the footage from a physical camera.

Unpredictable instructions, such as asking an applicant to make a particular movement or read changing numbers, can make prepared recordings harder to use, while information about the device can help determine whether the session comes from ordinary customer equipment.

Applying these checks together gives organizations a better chance of detecting the combined use of false documents, deepfakes, and human operators described in underground KYC advertisements. 

Flare gives organizations additional visibility by monitoring criminal forums for exposed identities, stolen credentials, active login sessions, and threats connected to their organization. Security teams can use these alerts to identify affected accounts, invalidate exposed access, and investigate identity-related activity before it develops into account takeover or further fraud.

Learn more by signing up for our free trial.

Sponsored and written by Flare.