Summary
- Flare research identifies underground sellers offering documents, videos, and account access intended to defeat identity checks.
- The observed marketplace activity concerns claims made by criminals and does not prove every advertised service works.
- Financial institutions face a continuing challenge distinguishing reliable identity verification from apparently legitimate but fraudulently obtained credentials.
Underground criminal marketplaces are advertising increasingly specialised services intended to bypass identity checks used by financial institutions, combining fraudulent documents, manipulated media, and accounts claimed to have already passed verification.
Research from cybersecurity company Flare, published on 19 October, examines criminal offerings associated with Know Your Customer procedures, often referred to as KYC.
The research draws on marketplace activity observed between March and September 2026 and describes how sellers advertise assistance with documentary checks, live identity verification, and the transfer of accounts that supposedly meet financial onboarding requirements.
The existence of an advertisement does not establish that the service is effective or that every claimed bypass has succeeded against a regulated institution.
Nevertheless, the range of services observed indicates that identity fraud has developed beyond the production of individual forged documents.
Fraudulent identities sold as a service
Financial institutions use KYC checks to establish the identity of customers and assess the risks associated with providing financial services.
Depending on the product and customer, those checks can involve documents, photographs, live identity verification, contact details, sanctions screening, and information about the intended use of the account.
Controls may also continue after onboarding through transaction monitoring and additional verification when suspicious activity or changes in customer information occur.
Flare’s research describes criminal offerings that attempt to target several parts of this process.
Some sellers advertise manipulated identity documents, while others claim to provide supporting photographs or video designed to satisfy verification procedures.
Accounts represented as already verified are also offered for sale, potentially shifting the criminal activity from attempting to pass a new identity check towards obtaining control of an account that has passed one previously.
Such services reflect the commercial demand for financial accounts that can be used without accurately identifying the person controlling them.
The advertisements do not establish a uniform technical capability across providers. A seller may exaggerate success rates, resell compromised assets, or advertise access that cannot be delivered.
Controls beyond document authenticity
One challenge for financial organisations is that different components of identity verification can fail independently.
An authentic-looking document may still contain false information, while a legitimate account may subsequently be transferred or used by someone other than its verified holder.
Live verification seeks to address some document fraud risks, but the appearance of manipulated photographs and video introduces additional uncertainty about the reliability of media-based evidence.
Organisations also need to assess whether the declared identity remains connected to the person controlling the account after the original verification.
Account monitoring can therefore be as important as the onboarding procedure itself.
The US Department of Justice case involving the operator of OnlyFake provides a separate example of law enforcement action against digital document fraud. The operator pleaded guilty in February 2026 in connection with a service that generated fraudulent identity documents.
That case does not establish that all providers described in Flare’s later research are connected to OnlyFake. It demonstrates that criminal document production has already attracted enforcement attention.
European financial-sector exposure
Identity verification failures can affect banks, payment services, cryptocurrency platforms, and other businesses required to establish customer identity and investigate suspicious activity.
European institutions operate under anti-money laundering obligations as well as data protection and security requirements that influence the handling of customer records.
Fraudulent onboarding can create exposure beyond the initial account opening, particularly where an account is subsequently used for unauthorised transfers, financial crime, or the movement of criminal proceeds.
At the same time, increasingly intrusive verification processes create their own challenges involving privacy, accessibility, and exclusion of legitimate customers.
The appropriate balance cannot be established from marketplace advertisements alone. The effectiveness of individual verification methods needs to be evaluated against demonstrated fraud attempts and observed outcomes.
The research also has methodological limits. Flare’s visibility depends on the markets and sources it monitors, and activity within those sources should not be assumed to represent every form of identity fraud.
A large volume of advertisements may reflect commercial competition among sellers rather than a corresponding rise in successful account compromises.
The findings nevertheless point to a developing market in which criminals attempt to sell different stages of the identity fraud process as separate services.
Financial institutions can no longer treat the completion of a single onboarding check as conclusive evidence that the account will remain under legitimate control throughout its lifecycle.
Flare’s observations establish the availability and promotion of such criminal offerings during the review period. The prevalence of successful bypasses and the resulting losses across UK and European financial institutions remain unquantified in the material reviewed.
