OnlyFake was a real criminal service that sold AI-generated identity documents designed to pass both human and automated identity checks. Its operator said the service enabled fraudsters to create fake passports, driver’s licenses, and other documents at scale for uses such as opening cryptocurrency accounts under another person’s name.
OnlyFake was a real criminal service built to automate the creation of fake identity documents. According to reporting, its operator built a website that autopopulated a fake ID template with whatever personal data a customer wanted, producing passports, driver's licenses, Social Security cards, and similar documents on demand. Buyers could request a specific document, such as a British passport, and receive a realistic image generated within minutes.
What set OnlyFake apart was not just the document template itself but the presentation. The service generated photos that made the fake documents appear to be sitting on a sofa, carpet, or desk, mimicking the kind of casual phone photo a real person might take when asked to verify their identity. That staging detail was specifically intended to help the images pass as authentic phone photographs rather than obviously synthetic images.
The documents were designed to defeat two different layers of defense at once: human reviewers manually checking submitted IDs, and automated systems that scan documents for inconsistencies. By targeting both at the same time, OnlyFake increased the odds that a fabricated identity would slip through account-opening or onboarding processes undetected.
The low cost and ease of generating these documents compounded the risk. A convincing image of an ID could reportedly be produced for just a few dollars, lowering the barrier for large-scale abuse. The U.S. Department of Justice said the service generated more than $1 million by selling fake IDs for roughly $15 each, illustrating how cheaply a seemingly minor document check could be undermined.
Organizations that rely on photographed identity documents for account opening or business registration should watch for:
Defending against AI-generated identity fraud requires moving beyond a single-point check. KYC and fraud teams should use layered verification rather than trusting an uploaded photo alone, especially for higher-risk account openings or corporate registrations. Teams should also be trained to treat a realistic-looking document photo with caution when it is the only evidence presented, and to escalate cases where identity details conflict with independent behavioral or device signals. Building this kind of scrutiny into account-opening workflows reduces the chance that a fabricated identity, however convincing, can unlock access to financial systems.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
OnlyFake was a criminal service that sold AI-generated identity documents, including fake passports, driver's licenses, and Social Security cards, designed to pass identity checks at scale.
The service generated document photos staged on surfaces like a sofa, carpet, or desk so they resembled genuine phone photographs, and the fakes were built to fool both human reviewers and automated document-scanning systems.
According to the operator, Yuriy Nazarenko, buyers used the fake documents for purposes such as opening cryptocurrency accounts under someone else's name, and North Korean fake IT workers reportedly used the service as well.
Organizations should avoid relying solely on uploaded document photos for high-risk decisions, use layered identity verification, and train fraud and KYC teams to escalate applications where identity details do not match account behavior or other signals.
A driver’s license on a sofa looks real. That’s the trick. OnlyFake sold AI-generated IDs for about fifteen dollars each. It could make a fake license or passport look like a casual phone photo on a sofa, carpet, or desk. The applicant claims to be the person on the ID, hoping you’ll approve a crypto account. A convincing photo isn’t proof the document, or person, exists. If the ID photo is the only proof, pause approval and send the application for layered identity review.
U.S. authorities sanctioned people supporting a real North Korean scheme that placed workers in legitimate U.S. businesses using false identities and fabricated job applications. The workers reportedly used AI to tailor resumes and cover letters, create profile photos, and even conceal their…
Employers are encountering fraudulent job candidates who use real-time face swaps and cloned audio to pass remote interviews, then send a different person to onboarding. The article describes this as a real and growing hiring-fraud problem, especially for high-access technology and defense roles,…
A Ukrainian corruption investigation uncovered a network accused of paying officials to protect fraudulent call centers. The centers allegedly targeted victims in Ukraine and abroad by posing as bank employees, law enforcement officers, or financial advisers, and by directing people to fake…
Attackers reportedly used a fake recruiting process to target Binance software engineers over several months. They built trust through a legitimate job platform and a fake HR interview, then persuaded an engineer to download a malicious coding assignment onto a work computer. That access was later…
A Banca Ifis manager received payment-request emails from someone posing as a colleague and approved transfers totaling about €23.8 million. The incident is a business email compromise (BEC) case: the attacker used a trusted internal identity and a routine payment workflow rather than a technical…
Cisco Talos investigated a VYPR ransomware incident in which an attacker used a voice-phishing call to trick a user into starting a Microsoft Quick Assist remote-support session. Talos also observed IT help desk impersonation in several other incidents, showing that a seemingly routine support call…
