A website is using “neural networks” to create fake digital IDs that can pass the identity verification process on popular websites and apps.
It costs only $15 to generate a fake ID on the site — called OnlyFake. Users can create different types of IDs, including passports and driver’s licenses, 404 Media explained in an exposé on Monday.
The owner of OnlyFake — who goes by “John Wick” — claims that the IDs generated on the site can bypass verification on Binance, Revolut, Wise, Kraken, Bybit, Payoneer, Huobi, Airbnb, OKX, and Coinbase. This means they can be used for bank fraud and money laundering.
“Many use this service for carding, creating fake bank accounts and.. to unban their crypto accounts like Binance where they ask ID proofs,” cybersecurity researcher Abhishek Mathew told 404 Media.
OnlyFake claims it uses “neural networks” and “generators” to create fake IDs, and can generate up to 20,000 ID documents daily. The site even alters the image data to make it appear like it was taken using an iPhone and Huawei smartphone. It also falsifies GPS coordinates and image timestamps to lend further authenticity to the fake ID image.
Interestingly, the site does not seem to use typical generative artificial intelligence technology (like ChatGPT and DALL-E) to create synthetic IDs, Professor Hany Farid at UC Berkeley told 404 Media, since that would cause unacceptable image inconsistencies.
“The deployment of neural networks to generate high-quality fake documents on a large scale raises significant concerns,” Jeff Sims, Principal Security Engineer at HYAS, told VPNOverview.
OnlyFake ID Used to Verify Crypto Account
404 Media tested OnlyFake to create a California driver’s license using arbitrary personal details and biographical information.
The process included uploading a passport photo, selecting a signature from automatically generated options, and finalizing the ID creation. They got an image of a realistic-looking California driver’s license sitting on a fluffy carpet.
It’s unclear how many users are patronizing OnlyFake. However, Blockchain records show that the users on the site have shelled out over $23,500 in Bitcoin, 404 Media said.
Wick and his team boasted about having a “unique algorithm” capable of generating New York driver’s licenses (DLs), which are particularly challenging as they have “a window and complex curved text.”
404 Media successfully used a fake British passport ID generated on OnlyFake to pass the identity verification process on a cryptocurrency exchange, OKX.
“The British passport I used to bypass identity verification worked first time. I had no issues with it whatsoever. Only reason I didn’t use the California license was because OKX doesn’t accept US IDs,” 404 Media’s Joseph Cox said on X.
‘The Era of Rendering Documents Using Photoshop Is Coming to an End’
Today, it’s easier than ever for cybercriminals to forge and steal IDs using AI tools and illegal services like OnlyFake. In December 2023, the Identity Theft Resource Center (ITRC) warned that identity crimes would “reach new levels” in 2024.
“The era of rendering documents using Photoshop is coming to an end,” Wick said.
Senator Ron Wyden told 404 Media that AI technologies capable of creating counterfeit IDs and realistic video deepfakes represent a significant threat of fraud to government bodies, financial entities, and various businesses. He emphasized the need for the U.S. to implement reliable, authenticated identification systems to ensure Americans can confirm their identities during critical or risky interactions with government and private organizations.
Wick said they created OnlyFake by feeding their system large amounts of ID documents.
“Although this application of the technology [neural networks] likely doesn’t come as a surprise to cybersecurity experts—given its natural alignment towards nefarious uses—it sharply highlights the urgent need to develop countermeasures,” Sims explained.
“Specifically, there’s a critical need for models capable of detecting artificially synthesized voices, images, or text intended for fraudulent purposes,” he added, noting that while this would be a complex challenge, it requires “immediate and focused attention.”
How to Protect Yourself From Identity Crimes
Personal information, including IDs, stolen online usually ends up on the dark web, where they’re purchased by cybercriminals and used for various illegal purposes.
404 Media cited a Telegram post where Wick and the OnlyFake team offered to buy high-quality ID images for $100 each, ostensibly to train their system.
In response to these alarming developments, we recommend:
- For businesses, especially those involved in financial transactions, investing in advanced identity verification processes beyond basic document checks is essential. This could include biometric verification, multi-factor authentication, and real-time identity checks.
- Businesses must also employ AI and machine learning-based tools that are capable of detecting anomalies in documents.
- Individuals should be cautious about sharing personal information online. It’s important to learn about phishing scams that can allow cybercriminals to steal personal data for use in such forgeries. Also, learn about signs of identity theft and what to do if you’re a victim.
- Use a dark web monitoring service to check if your data has been leaked online.
- Report suspected forgery and fraud to the authorities. Collaboration between businesses, cybersecurity experts, and law enforcement can help to combat sophisticated forgeries.
For more news, follow us on X (Twitter), Threads, and Mastodon!
