Joseph CoxFeb 5, 2024

New from 404 Media: inside the underground site where "neural networks" churn out fake IDs
- I tested the service, called OnlyFake, made two IDs in minutes
- I then used one to successfully bypass the identity verification check on a cryptocurrency exchange
- Massive implications for crime, cybersecurity. What does it mean for us when fake IDs are a mouse click away?

https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/

Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs

The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large.

404 Media
Show threadJoseph Cox

Here is how I used it to bypass identity verification on the cryptocurrency service OKX:
- asks for passport
- take photo of this one I made on OnlyFake
- site reviews it
- success

https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/

Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs

The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large.

404 Media
Feb 5, 2024 at 3:20pmWeb
Show threadJoseph CoxFeb 5, 2024
Update: @RonWyden comments on our investigation into neural networks + fake IDs. Says it shows the need for secure, authenticated IDs https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/
Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs

The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large.

404 Media
Show threadAlanna 🏳️‍🌈🏳️‍⚧️Feb 5, 2024
@josephcox That's not even the correct layout for a British Passport.
Show threadMike RoachFeb 5, 2024

@josephcox This kind of identify "verification" is such a joke. There are right ways of doing online ID verification and this isn't it.

A bunch of countries here in Europe have government-issued digital IDs that we use to sign in to all kinds of things. It's the only way to sign in to government services, banks, even your phone company. It's the only way to sign contracts online too. Protected by biometrics, of course.

There's no excuse for this not being implemented worldwide.

Show threadNyancient CthUwUFeb 6, 2024
@mroach @josephcox so much this. We've had proper cryptographic ID verification in Sweden since the early 00s. If the implications of pictures of IDs getting easier to generate is that the US stops pretending that JPEGs are IDs, then this is a net positive.
Show threadMike RoachFeb 6, 2024
@nyancient @josephcox Once you’ve used BankID (or MitID on this side of the Øresund) you can’t imagine a society functioning without. And, they don’t, really.
Show threadhaifischFeb 5, 2024
@josephcox ain’t this like… borderline financial fraud?
Show threadjtorrex Feb 6, 2024
@josephcox Simply brutal, I wonder how online services will manage the triage of "faked" kyc identifications.