NewThe detectors that scored perfect collapsed the hardest under attack.
Back to publications
Fraud story

When a 15-dollar AI ID passed a live exchange KYC check.

The OnlyFake case is the cleanest documented example of an automated control being beaten by generative AI. A synthetic passport image cleared a crypto exchange's document verification. The control that failed was a machine, not a person, and that distinction is the whole point.

Article · June 2026 · 6 minute read

In February 2024, a service called OnlyFake was selling AI-generated ID documents for about 15 dollars each, and a reporter used one to clear the document-verification step at the crypto exchange OKX. The control that returned the pass was an automated authenticity check, not a human reviewer. That is the difference between a convincing image and a defeated control, and it is the only difference that scales.

The case

A viral image of a fake document is not, by itself, a fraud. Until it beats something, it is a picture, and the cases worth studying are the ones where it did.

OnlyFake is the clearest of those. First reported by 404 Media and picked up widely in early 2024, the service generated realistic identity documents for roughly 26 countries, passports and driver licenses among them, at about 15 dollars apiece and paid in cryptocurrency. Handed one of those images, a generated British passport, the Know Your Customer document check at the crypto exchange OKX returned a pass. The operator claimed the same approach worked at other major exchanges, and a Telegram channel of users echoed the claim.

The exchange's own response is the tell. Asked about it, OKX described fake-ID bypass as an industry-wide issue rather than a single-vendor slip, and once a failure is industry-wide, it lives in the control, not in one company's configuration.

What actually got bypassed

Coverage like this tends to collapse two things that need to stay separate. A human looking at a document and being convinced is social engineering, which is real, dangerous, and not what happened here. An automated system handed a synthetic document and returning a pass is a defeated control, and that is exactly what happened here.

Specifically, the document-authenticity layer, the software that decides whether an uploaded ID is genuine, accepted a generated image with no person in the loop at the moment the decision was made. The distinction matters because only the second kind scales. Fooled once, a human reviewer is fooled once. A control that accepts a 15-dollar generated passport accepts it every time, at the speed of an API, for as many accounts as someone cares to open.

Why the realism was the wrong focus

Most of the public reaction to AI-generated documents fixates on how real they look, and the realism is necessary. It is not, though, what beat the control. What beat the control was that the control was checking the wrong thing: surface appearance, layout, font, the presence of expected fields, rather than a signal a generator cannot reproduce.

The same lesson shows up across synthetic-media detection, and security researchers tracking the market reach the same place when they ask whether deepfakes can bypass online ID verification. Keyed on a feature the attacker can trivially supply, a detector passes the attacker, however strong its datasheet reads. The question is never whether the artifact looks right. The question is whether the control reads a property the artifact cannot fake, which is the thesis behind our benchmark of how detectors collapse once the test stops being clean, and the reason AUC is the wrong number for a document check in the first place.

What this means for document checks

If your onboarding flow accepts a scanned or uploaded identity document as proof, the OnlyFake case is your threat model rather than a curiosity. Document-image authenticity is no longer a control you can lean on in isolation; it belongs in a defense-in-depth stack alongside issuer-side confirmation, cryptographic provenance where it exists, and cross-checks against authoritative records, the things a generated image cannot supply on demand. The same ring that beats the document step then meets the face-match and liveness step, and we walk through that failure in the Hong Kong onboarding case.

And here is the part teams skip: you do not actually know whether your current document check would accept an OnlyFake-class input until someone tries it against your specific deployment, with current-generation tooling. Vendor benchmarks age, generators do not wait, and the only honest answer to whether your control holds is a measured one.

Margen does not sell document verification or detection. We are an independent third party that red-teams these controls under adversarial, platform-realistic conditions and reports, with a number and a margin of error, where they hold and where they break.