OnlyFake turned identity forgery from a craft into a software service

Yuriy Nazarenko began by manually editing passports in Photoshop, a process he says could consume a week for one high-quality document. He then built templates, automated the fields and added generative image tools. The resulting service, OnlyFake, could produce customised scans and phone-like photographs of passports, driving licences, Social Security cards and utility documents, sometimes in batches of hundreds or thousands, 404 Media reports. Buyers paid in cryptocurrency, with individual documents advertised for about $15.

The Department of Justice independently verifies the core criminal operation. Nazarenko pleaded guilty in February to conspiracy involving fraudulent identification documents and agreed to forfeit $1.2mn. Prosecutors say OnlyFake generated at least 10,000 digital fake IDs between roughly 2021 and 2024, offered documents for all 50 US states and passports from about 56 other countries, and sold bulk packages of as many as 1,000. Those facts establish scale, but not every claim in Nazarenko’s new account. His statement that North Korean fake IT workers used the service is reported by 404 Media and has not been established in the cited court record.

OnlyFake attacked a specific weakness in know-your-customer systems. Many banks, crypto exchanges and company-registration services ask applicants to upload a scan or photograph of an identity document. The service produced not just the flat document but the visual context expected by those checks: an ID apparently lying on a carpet, sofa or desk. In 2024, 404 Media used an OnlyFake document to proceed through the identity-verification flow at crypto exchange OKX, demonstrating that at least one real system could be fooled.

Generative AI mattered because it collapsed the skilled labour in the forgery process. Nazarenko still needed document knowledge, templates, infrastructure, payments and customer acquisition; this was an illegal technology business, not a single prompt. But once those pieces existed, the marginal cost of another identity fell sharply. Competitors could copy the model, and customers no longer needed access to a specialist forger. Automation changed the relevant threat from occasional convincing fakes to an API-like supply of them.

Defending against that market requires more than improving an image classifier. A verification system that accepts a picture of a document is testing whether pixels look plausible, not whether a government issued the credential to the person presenting it. Stronger designs bind the check to authoritative records, cryptographic credentials or live challenge-response signals and monitor reuse across accounts. Each creates cost, privacy and exclusion risks of its own. The underlying lesson is uncomfortable: once synthetic documents are cheap, the photograph cannot remain the root of trust.