AI-generated fake IDs claimed to pass crypto exchange KYC are selling for $15
(Coin Telegraph)-07/02/2024
A new service claiming to use artificial intelligence (AI) “neural networks” and “generators” to create fake driver licenses and passports has reportedly succeeded in passing Know Your Customer (KYC) checks on multiple crypto exchanges.
The cost? Only $15 a pop.
The site, OnlyFake, generates realistic fake driver’s licenses and passports from 26 countries, including the United States, Canada, Britain, Australia and multiple European Union countries, and takes payment in multiple cryptocurrencies through Coinbase’s commercial payments service.
404 Media reported on Feb. 5 that it successfully bypassed the KYC verification of crypto exchange OKX using a photo of a British passport the outlet generated with the site, where the ID appeared to be laid on a bedsheet as if a picture of it was taken.
A Telegram channel seen by Cointelegraph also shows the site’s users sharing their apparent success in using the IDs to bypass verification at various crypto exchanges and financial service providers, including Kraken, Bybit, Bitget, Huobi and PayPal.
The service could be a boon for crypto scammers and hackers who could use fake documents to open exchanges and bank accounts, protecting their real identity and making them more difficult to track.
OnlyFake’s pseudonymous owner “John Wick,” claimed to 404 Media that the IDs could bypass KYC checks at exchanges Binance, Kraken, Bybit, Huobi, Coinbase and OKX, along with the crypto-accepting neobank Revolut.
An OKX spokesperson told Cointelegraph it denies any allegations or implication that it “condones, accepts, or disregards fraudulent conduct” and is working with its teams and external partner to investigate the report.
“We are committed to aggressively fighting fraudulent conduct on our platform and seeking the highest standards of compliance,” it added. “The abusive use of AI to conduct fraudulent activity is an evolving and industry-wide challenge which OKX is comprehensively addressing.”
The OnlyFake site, however, claims it doesn’t “manufacture forged documents as it is illegal,” and its terms state its “templates are only for use in movies, TV shows [and] web illustrations.”
It’s understood that generating a fake document on the site takes less than a minute. Users can upload their own photo or one chosen randomly from a “personal library of drops and not using a neural network,” according to a Telegram post seen by Cointelegraph.
An associated Telegram channel has posted dozens of examples of fake driver’s licenses and passports appearing to be laid out on kitchen countertops, bedsheets, carpets and desktops — similar to how they would be taken by someone if used for online verification.
The post also states that 100 fake IDs can be generated simultaneously using Excel spreadsheet data.
OnlyFake also offers image metadata spoofing, with users able to forge the GPS location, date, time and the device that took the alleged photo, as some identity verification services check such data to determine authenticity.
Crypto hackers and scammers have long used methods to spoof information and gain access to crypto exchanges while hiding their real identities.
In late 2022, blockchain security firm CertiK uncovered an online black market of individuals selling their identities for as little as $8, agreeing to act as the verified face of fraudulent crypto projects and open bank and exchange accounts on behalf of malicious actors.
The widespread, easy access to AI deep fake tools has also raised concerns from crypto industry executives on the effectiveness of video verification used in some identity checks.
Binance chief security officer Jimmy Su told Cointelegraph in May 2023 that there was a rise in scammers attempting to dupe exchange KYC checks using deep fakes and warned the videos would soon be convincing enough to trick human operators.
Cointelegraph contacted Coinbase for comment on the service using its commerce product but did not receive an immediate response.
Binance, Kraken, Bybit, Bitget, Revolut, Huobi and PayPal did not immediately respond when contacted for comment on the users alleging to have bypassed their identity checks.
