The fraud is a service, not a single fake
A forged identity document is only one part of the underground offer. Sellers advertise combinations of fabricated records, manipulated images or video, and help from a person who can take part in a live verification session. That changes the problem for banks, exchanges, and other services: they’re not always checking one document against one face. They may be facing a coordinated package designed to look consistent across the entire signup.
Reporting by BleepingComputer describes sellers tailoring identity and financial documents to verification requests. The packages can include bank statements and other records used to confirm details such as an address, income, or account ownership. The essential selling point is coherence: names, photographs, addresses, and supporting information need to agree well enough to avoid an obvious mismatch.
That does not mean every listing works, or that every buyer gets past a platform’s checks. It does show how the market frames the service: not merely “here’s an ID,” but help assembling the pieces around a claimed identity.
How an identity package comes together
The broad sequence is familiar from legitimate onboarding. Someone supplies identity information, presents documents, links the claimed identity to a face, and completes checks through a device or browser session. Underground sellers try to manipulate each of those layers.
A package may start with personal details and documents presented as evidence for them. Photographs or video then connect the claimed identity to a face. Device and browser preparation may be used to make the session appear consistent with an ordinary customer, while a live verification stage may involve synthetic media or a human operator. Those are distinct components, and a weak match between them can create a reason for a platform to pause or investigate.
The sellers’ alleged tailoring matters. A generic fake document and a separate, unrelated face image are easier to spot if their details conflict. A set prepared around one customer’s requested checks is intended to reduce those inconsistencies. That’s the service logic described in the BleepingComputer reporting—not proof that the controls are defeated, but a reminder that document review alone can leave gaps.
Live checks raise the stakes
Remote identity checks can compare a document photograph with a live camera image. Some systems use passive liveness analysis on a short recording. Others ask for an action: turn your head, blink, speak, or read changing numbers displayed during the session.
The underground offers described by BleepingComputer include altered photographs and AI-generated video based on the face in an identity document. The reporting also describes claims of tools that modify a camera image during a live session, as well as “human KYC” services in which another person performs the facial or video check using prepared identity material.
This is a different challenge from rejecting a static upload. A prepared image can be assessed as an object; a live interaction tests whether the person or media can respond to what the system requests. A number-reading prompt, for example, requires the participant to react to content presented during the session. The source describes advertisements for guidance around such checks and a recruitment post seeking someone to use deepfake tools in a live camera session. The claims are evidence of what sellers promote, not independent confirmation that every advertised technique succeeds.
OnlyFake shows the scale of document fraud
The case of OnlyFake offers a concrete example of digital identity documents sold at scale. According to SC Media, the operator pleaded guilty in February 2026 for creating more than 10,000 fraudulent digital identity documents.
Bitdefender’s account says OnlyFake generated over 10,000 counterfeit digital IDs between 2021 and 2024. Its offerings included U.S. identification documents and passports from other countries; customers could choose images designed to resemble scans or realistic photographs. The operator agreed to forfeit approximately $1.2 million.
The point isn’t that one case explains every underground marketplace. It doesn’t. But OnlyFake illustrates why digital presentation matters: an online verification workflow may receive an image rather than a physical document, and a convincing-looking file can be offered as a product. That makes provenance, alteration detection, and cross-checking more important than visual plausibility alone.
Verification can continue after signup
KYC isn’t necessarily a one-time gate. The BleepingComputer report describes sellers offering continued verification and account-recovery assistance after an account is handed over. A later request for another check can leave the buyer dependent on the person or material used during enrollment.
That has an uncomfortable implication for firms: a successful onboarding decision doesn’t settle who controls the account over time. If a later verification request is handled by a different person, or if account activity doesn’t fit the profile established at signup, the mismatch may surface only after access has been granted. Continued monitoring and repeat checks can therefore matter alongside the initial document review.
The same source describes customer due diligence as identifying the customer, understanding the purpose of the relationship, and monitoring it over time. In other words, identity is not just a document image captured on day one. It’s an ongoing relationship between the declared customer, the evidence collected, and subsequent activity.
Make checks work together
No single check can establish everything. The reporting points to a layered approach: examine the application as a whole, compare identity details with supporting records and facial images, and look for inconsistencies across the session. Guidance discussed in the BleepingComputer article includes collecting documents and facial images directly during verification, checking whether documents have been altered, and detecting software that replaces footage from a physical camera.
Live challenges can add friction to prepared media, especially when instructions are unpredictable and require an immediate response. Device information can also help assess whether a session appears to come from ordinary customer equipment. These measures are not guarantees; they are ways to test different parts of the same claimed identity rather than trusting one convincing-looking artifact.
Teams should also treat advertised capabilities carefully. A criminal forum listing is a signal about what sellers claim to offer, not a controlled test of a vendor’s tools or a measure of how often a bypass works. Still, it can inform threat modeling: build checks around combinations of documents, faces, devices, and behavior, and be prepared to revisit an account when later evidence no longer fits.
The market’s real product is coordination. A document, a face, a device session, and a person available for follow-up can be sold as pieces of one service. Defenses need to connect those pieces too—and keep asking whether the person behind the account is still the person the evidence says they are.
