This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
OnlyFake was an AI-powered platform that generated and sold over 10,000 counterfeit identity documents, including passports and driver's licenses, to facilitate fraud. The service allowed users to bypass Know Your Customer (KYC) verification protocols on major cryptocurrency exchanges and financial institutions. The operator, Yurii Nazarenko, pleaded guilty to conspiracy to commit fraud, acknowledging that the platform earned hundreds of thousands of dollars and enabled money laundering.
Researchers from Au10tix discovered the relaunch of OnlyFake, a site offering AI-generated fake IDs. Despite an earlier takedown, the site reemerged with disclaimers and new tools, including handwritten signature generation. These fakes are challenging biometric verification systems and are reportedly being used to perpetuate fraudulent activity.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
Automated identity verification systems failed to robustly detect the AI-generated counterfeit documents.
The OnlyFake platform was used to generate counterfeit identity documents to commit financial fraud and bypass KYC security measures on financial platforms.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human actors intentionally deploying and using an AI-powered platform to generate counterfeit documents for financial fraud.
Added categories peak at 4: Severe (Epistemic Harm, Inferred)
The OnlyFake platform utilized AI to mass-produce over 10,000 highly realistic counterfeit identity documents for 15 dollars each. These fakes successfully bypassed Know Your Customer (KYC) protocols on major global cryptocurrency exchanges, facilitating international money laundering and financial fraud. While the operator was arrested, the incident highlights a substantial vulnerability in global digital financial security.
The AI system, OnlyFake, functioned as a generator that produced specific, well-defined counterfeit documents based on direct user inputs (such as names, photos, and Excel data) without exhibiting autonomous planning or goal-directed behavior.
Limited Risk: The system generates deepfakes or synthetic content (counterfeit documents), which falls under transparency obligations for AI-generated content, though its malicious application constitutes fraud.
The primary function of the OnlyFake platform was to generate highly realistic, synthetic images of counterfeit identity documents to deceive verification systems.
The reports provide clear, consistent, and detailed accounts of the OnlyFake platform's operations, the arrest and guilty plea of its operator, and the technical testing of the generated documents by cybersecurity researchers. There is little ambiguity regarding the AI's role as a tool for generating fake documents.
None
Technology
AI-Powered ID Generation
AI algorithms generated realistic fake IDs including passports.
Signature Generation Tool
Automated handwritten signature tools increased fake document realism.
Weak Automated Verification
Identity systems failed to detect non-visible digital manipulations.
Data Inputs
Excel Data Integration
Allowed mass-generation of fake IDs using spreadsheet data inputs.
Document Template Variety
Wide range of templates for 56 countries and all 50 US states.
Human Factors
Human-in-the-Loop Verification
Human reviewers failed to see deepfakes that only automation detects.
Intentional Fraudulent Use
Customers knowingly purchased fake IDs to bypass security protocols.
Process and Methods
Inadequate Verification Checks
Standard verification systems ran too few checks to flag fakes.
Bulk Generation Process
System allowed simultaneous generation of 100 fake IDs using Excel.
Management
Disclaimers as Liability Shield
OnlyFake used disclaimers to shift blame while enabling illegal acts.
Profit-Driven Operation
Operators prioritized illicit gains from selling over 10,000 fake IDs.
Regulatory Environment
Lack of Solution Accreditation
Regulators did not accredit verification tools based on defense levels.
Jurisdictional Challenges
Operating across borders hindered rapid shutdown of the fraudulent site.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
