A chilling new threat has emerged: threat hunters recently uncovered an underground industry group boasting the ability to "Verify KYC All Platforms." Their sophisticated scheme involves generating deepfake facial videos from documents for initial KYC checks, then producing high-quality fake documents using advanced laser engraving and other technologies. These forged identities are then deployed to bypass platforms' crucial secondary KYC inspections, posing a significant risk to security.

Background

As of May 14, 2025, Threat Hunter’s Intelligence Team uncovered the widespread distribution and sale of "Verify KYC All Platforms" products by an underground industry group on anonymous group chat. Here's a look at their sales advertisement:

The Modus Operandi

Subsequent investigations revealed the full extent of this operation: a criminal gang not only supplying facial forgery services but also highly realistic fake identity documents. They achieve this by employing advanced laser engraving and other technologies to print the forgeries.

The following screenshot, released by the underground industry itself, illustrates their intricate process for manufacturing counterfeit IDs.

Upon inquiry, this underground industry provides the comprehensive suite of illicit services for a flat fee of $60.

The underground industry primarily sources identity information from the dark web and other compromised platforms. While this leaked data often includes ID photos, its origins make secondary manual verification nearly impossible.

This vulnerability is precisely what the "Bypass Face Verification" and "Review with real people identify" services exploit. Criminals first leverage stolen data to forge realistic face videos for initial KYC authentication. They then provide fabricated identity documents, meticulously recreated through laser printing and other advanced techniques, ensuring the details appear authentic enough to deceive subsequent manual audits and bypass "real people" reviews.

Typical application scenarios

The core service offered by this underground industry is to circumvent both face recognition and follow-up document verification. Purchasers of these services largely aim to compromise financial service platforms, using fraudulent KYC to execute illicit loans and other financial scams.

Threat hunters have already uncovered such attacks. The following screenshot shows a successful bypass of a major financial platform's KYC certification, achieved through the underground industry's facial and document forgery techniques.

This bypass capability is not limited to financial services; it also extends to non-financial platforms such as e-commerce sites where fraudsters forge merchant certificates after bypassing security.

The below screenshot illustrates the underground industry's methods in action, demonstrating their use of face and document forgery to circumvent an e-commerce platform's merchant authentication process.

Recommendations

To stay ahead of evolving threats, organizations need comprehensive and accurate intelligence services that continuously monitor KYC bypass tools and techniques. This proactive approach ensures timely discovery of the latest attack methods and tools.

Threat Hunter Intelligence Detection Service specializes in precisely this. We provide deep and critical intelligence monitoring, in-depth and detailed analysis of these illicit tools and techniques, and reconstruction of attack chains. This allows us to deliver refined, actionable strategies that empower clients to respond swiftly and enhance their overall capacity to identify, detect, and counter risks.

Learning more about fraud risks relevant to your business? Let's talk.