Flare Tracks Underground KYC Fraud Services

Cybercriminals advertise forged identity documents, manipulated images and videos, live verification assistance, and accounts they claim have already passed Know Your Client (KYC) checks, according to threat intelligence firm Flare.

Flare says it collects hundreds of thousands of search results each year related to KYC services and verified-account trading. Activity it observed from March to September 2026 shows sellers packaging services for underground markets.

In February 2026, the operator of OnlyFake pleaded guilty in the United States for a service that generated more than 10,000 fraudulent digital identity documents. The U.S. Department of Justice said the documents helped cybercriminals conceal their identities, evade checks at banks and cryptocurrency exchanges, and launder money.

Flare also observed sellers offering identity and financial records tailored to verification requests, as well as altered photographs, AI-generated videos, and help during live checks. One recruitment post sought someone to use deepfake tools to alter camera footage during verification. Researchers also saw guidance advertised for checks in which applicants must read numbers shown on screen.

Some sellers offer further verification or account-recovery help after handing over an account, Flare said. The company describes this as extending the service when a platform requests another identity check.

FinCEN has warned financial institutions about deepfakes and fraudulent documents used to bypass customer checks. NIST recommends collecting documents and facial images during the verification session, checking for alterations, and detecting software that replaces physical-camera footage.