The Challenge
Between March and September 2026, Flare's threat intelligence platform collected hundreds of thousands of search results related to fraudulent Know Your Client (KYC) services across underground markets. The surprise wasn't the volume but how these services were packaged.
Operators weren't just selling forged documents anymore. They offered complete identity verification packages: fabricated documents matched to manipulated photographs, AI-generated videos that responded to liveness checks, human operators completing live verification sessions, and post-delivery support for additional checks.
The OnlyFake case demonstrated the scale. In February 2026, its operator pleaded guilty after generating over 10,000 fraudulent digital identity documents for customers needing to bypass checks at banks and cryptocurrency exchanges. Customers could select document types from dozens of countries and choose whether each appeared as a scan or photograph of a physical ID.
For financial institutions, this created a verification problem that standard document checks couldn't solve. If every element of an application could be fabricated and coordinated, how do you distinguish a legitimate customer from a constructed identity?
The Environment and Constraints
Your KYC process operates under competing pressures. You need low friction for legitimate customers to complete enrollment, thorough verification to satisfy regulatory requirements, and detection capable enough to catch increasingly sophisticated fraud.
The underground market has adapted to each layer of your controls. Passive liveness checks that analyze a camera recording for signs of a real person can be defeated with AI-generated videos. Active checks that ask applicants to turn their head or read numbers on screen face deepfake tools that alter the camera feed in real time, allowing a human operator's movements to appear as the face shown in the identity document.
Flare researchers observed recruitment posts seeking operators who could use these tools during live verification sessions. One advertisement offered guidance specifically for live number-reading checks, where the applicant must respond to content presented during the session. The bypass required coordination and real-time adaptation, not just submission of a prepared recording.
The constraint isn't technological capability. It's that each verification step you add creates customer friction, and each automated check can be studied and defeated by sellers who specialize in that specific platform's requirements.
The Approach Taken
FinCEN recommends examining the complete application for inconsistencies between identity information, supporting records, facial images, and account activity. Different elements may be prepared by different people or tools, creating mismatches that a document-only review would miss.
NIST focuses on three technical controls: collect identity documents and facial images directly during the verification session rather than accepting uploads, check whether submitted materials have been altered, and detect software that replaces footage from a physical camera.
The third control addresses the deepfake problem directly. If you can determine whether the video stream comes from ordinary customer equipment or has been manipulated between the camera and your platform, you can flag sessions where the operator is using software to alter their appearance.
NIST also recommends unpredictable instructions. Asking an applicant to make a particular movement or read changing numbers makes it harder to use prepared recordings, though Flare's observation of sellers offering real-time assistance shows this creates a service opportunity rather than an absolute barrier.
Device and browser information adds another signal. Flare observed forum sellers discussing device preparation to make application sessions appear consistent with legitimate customers. If you collect data about the device, operating system, browser configuration, and network characteristics, you can compare that technical fingerprint against patterns associated with fraud operations.
Results and Metrics
The OnlyFake operator's guilty plea shows that law enforcement can disrupt these services, but it doesn't eliminate the market. Flare continues to observe hundreds of thousands of search results related to KYC fraud between monitoring periods, indicating that demand and supply persist despite enforcement actions.
For individual institutions, success means detecting fraudulent applications before account opening and identifying compromised accounts before they're used for money laundering or other financial crimes. The metrics that matter are false positive rates during enrollment (legitimate customers incorrectly rejected), false negative rates (fraudulent applications that pass), and time to detect when a verified account begins exhibiting suspicious behavior.
Flare's platform monitors criminal forums for exposed identities, stolen credentials, and active login sessions, allowing security teams to invalidate access before it becomes account takeover. This extends KYC beyond the enrollment moment into ongoing account monitoring, which Financial Action Task Force guidance describes as essential to customer due diligence.
What They Would Do Differently
The underground market's evolution toward complete service packages reveals a gap in verification strategies that treat each check as independent. Document validation, facial comparison, liveness detection, and device analysis each add value, but fraudsters now coordinate all elements to pass the complete sequence.
Flare researchers observed sellers offering post-delivery support, including assistance when platforms requested additional identity checks after account handoff. This means the verification relationship can extend beyond the initial sale, with buyers remaining dependent on sellers who control the identity material and participants used during enrollment.
If your institution treats KYC as a one-time gate rather than a continuous process, you're vulnerable to accounts that pass initial checks but later exhibit behavior inconsistent with the verified customer. Transaction monitoring must account for the possibility that the account was fraudulently established, and additional verification requests should use different methods than the original enrollment to prevent the same bypass from working twice.
Takeaways for Your Team
Don't rely on any single verification method. Fraudsters budget for the cost of bypassing your specific controls, and underground sellers specialize in particular platforms' requirements. Layer document validation, liveness checks, device analysis, and behavioral signals so that defeating one control doesn't grant access.
Examine applications for internal consistency. Names, photographs, addresses, and other details must match across all submitted documents because mismatches indicate that elements were prepared separately. Flare observed sellers offering customized packages where financial documents, identity cards, and photographs were tailored to individual verification requests, creating the appearance of consistency that a document-only review would accept.
Monitor criminal forums for your organization's exposed data. If credentials, active sessions, or identity material connected to your accounts appear in underground markets, you can invalidate access before it's exploited. This gives you detection capability that operates outside your verification controls, catching fraud that your enrollment process missed.
Collect technical signals during verification sessions. Device information, browser configuration, network characteristics, and behavioral patterns during the application can reveal whether the session comes from ordinary customer equipment or has been prepared to bypass your checks. This data becomes more valuable over time as you build profiles of legitimate versus fraudulent applications.
Review your post-enrollment verification process. If you request additional identity checks when account behavior changes, use different methods than the original enrollment. Otherwise, sellers who helped bypass your initial controls can offer the same service again, and the account remains compromised despite your additional verification request.
