Deepfake ID Sales Allegedly Persist as OnlyFake Reportedly Relaunches with New Fraud Tools

Researchers from Au10tix discovered the relaunch of OnlyFake, a site offering AI-generated fake IDs. Despite an earlier takedown, the site reemerged with disclaimers and new tools, including handwritten signature generation. These fakes are challenging biometric verification systems and are reportedly being used to perpetuate fraudulent activity.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The OnlyFake platform was used to generate counterfeit identity documents to commit financial fraud and bypass KYC security measures on financial platforms.

Additional risk subdomains

• 7.3 Lack of capability or robustness: Automated identity verification systems failed to robustly detect the AI-generated counterfeit documents.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human actors intentionally deploying and using an AI-powered platform to generate counterfeit documents for financial fraud.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system generates deepfakes or synthetic content (counterfeit documents), which falls under transparency obligations for AI-generated content, though its malicious application constitutes fraud.

AI system and alleged parties

• AI system: OnlyFake
• AI purpose: Deepfake Image Generation; Image Generation
• Behaviour type: Tool
• Alleged developer: OnlyFake
• Alleged deployer: Yuriy Nazarenko, Yurii Nazarenko, Uriel Septimberus, Tor Ford, OnlyFake, John Wick (OnlyFake)
• Alleged harmed parties: National security and intelligence stakeholders, Individuals using biometrics, Government agencies using biometrics, Epistemic integrity, Businesses using biometrics, Biometric security

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Substantial, indirect Substantial
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Substantial
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses and illicit gains, noting that the platform earned hundreds of thousands of dollars and the operator agreed to forfeit 1.2 million dollars.

Directly caused: The operator agreed to forfeit 1.2 million dollars in revenue generated from selling fake IDs, averaging 1.2 million dollars for this single continuous occurrence.

Indirectly caused: The fake IDs facilitated money laundering and financial fraud through cryptocurrency exchanges, though the exact amount of indirect financial losses to these institutions is not quantified.

Inferred additional harm: It is highly likely that the 10,000 fake IDs enabled millions of dollars in further financial fraud, theft, and laundered funds across various banking and cryptocurrency platforms.

Epistemic

Reported: The report explicitly describes epistemic harm in the form of highly realistic counterfeit identity documents generated by AI to deceive verification systems.

Directly caused: The platform generated over 10,000 fake driver's licenses, passports, and Social Security cards, successfully deceiving automated identity verification systems.

Indirectly caused: The proliferation of these realistic fakes undermines the reliability of digital identity verification and trust in government-issued documents.

Inferred additional harm: The widespread availability of cheap, high-quality AI-generated fakes is likely to cause systemic erosion of trust in online identity verification processes globally.

People affected

• Occurrences reported: 1
• People reportedly exposed: 10000

Potential causes

Management

• Disclaimers as Liability Shield: OnlyFake used disclaimers to shift blame while enabling illegal acts.
• Profit-Driven Operation: Operators prioritized illicit gains from selling over 10,000 fake IDs.

Technology

• AI-Powered ID Generation: AI algorithms generated realistic fake IDs including passports.
• Signature Generation Tool: Automated handwritten signature tools increased fake document realism.
• Weak Automated Verification: Identity systems failed to detect non-visible digital manipulations.

Data Inputs

• Excel Data Integration: Allowed mass-generation of fake IDs using spreadsheet data inputs.
• Document Template Variety: Wide range of templates for 56 countries and all 50 US states.

Human Factors

• Human-in-the-Loop Verification: Human reviewers failed to see deepfakes that only automation detects.
• Intentional Fraudulent Use: Customers knowingly purchased fake IDs to bypass security protocols.

Process and Methods

• Inadequate Verification Checks: Standard verification systems ran too few checks to flag fakes.
• Bulk Generation Process: System allowed simultaneous generation of 100 fake IDs using Excel.

Regulatory Environment

• Lack of Solution Accreditation: Regulators did not accredit verification tools based on defense levels.
• Jurisdictional Challenges: Operating across borders hindered rapid shutdown of the fraudulent site.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent, and detailed accounts of the OnlyFake platform's operations, the arrest and guilty plea of its operator, and the technical testing of the generated documents by cybersecurity researchers. There is little ambiguity regarding the AI's role as a tool for generating fake documents.

The OnlyFake platform utilized AI to mass-produce over 10,000 highly realistic counterfeit identity documents for 15 dollars each. These fakes successfully bypassed Know Your Customer (KYC) protocols on major global cryptocurrency exchanges, facilitating international money laundering and financial fraud. While the operator was arrested, the incident highlights a substantial vulnerability in global digital financial security.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Global financial institutions and cryptocurrency exchanges
• Alleged perpetrator: Yurii Nazarenko

Threat characteristics

• Imminence: Long-term. The operator was arrested and the primary platform dismantled, making this an ongoing strategic concern regarding KYC robustness rather than an active, immediate crisis.
• Autonomy: Human-controlled. The AI functioned as a generator tool, creating counterfeit documents based on direct human inputs and parameters without autonomous decision-making.
• Novelty: Evolved capability. While identity counterfeiting is an established threat, utilizing AI to mass-produce highly realistic, cheap digital fakes capable of bypassing automated KYC represents a significant technological evolution.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic assets, or critical infrastructure control systems were targeted or affected by this incident.
• Information security: Negligible. The incident involved financial fraud and document counterfeiting rather than state-sponsored information warfare, deepfake operations against leadership, or intelligence compromise.
• Sovereignty: Minor. The mass generation of counterfeit state-issued identity documents like passports and Social Security cards weakly undermines state verification authority, but impacts remained limited to digital financial fraud.
• Economic security: Substantial. The platform enabled the generation of over 10,000 fake IDs to bypass KYC and AML protocols on major global cryptocurrency exchanges, facilitating large-scale financial fraud and money laundering.
• Societal stability: Negligible. No significant threats to societal stability, civil liberties, or population-scale manipulation were observed, as the tool was used for targeted financial fraud.