The Confessions of an AI Fraud Kingpin

A few years ago, Yuriy Nazarenko sat at a desk in his grandfather’s apartment in Ukraine and, on a diet of cigarettes, Lay’s chips, and beer, painstakingly made digital copies of fake identity documents. One of his four computer screens had the messaging app Telegram open. Another displayed a scan of a passport in Photoshop filling the entire monitor. Pixel by pixel, with rap music blaring, Nazarenko edited each part of the passport. That included the MRZ codes, the block of text printed at the bottom of identity documents; the portraits to superimpose someone else’s face into the document; and the overall dimensions and quirks of each different type of passport. Nazarenko would sometimes sit for more than 12 hours at his computer, obsessively tinkering away, with a single, high-quality fake identity document taking up to a week of work. When someone thinks of fake IDs, maybe they imagine a spotty underage teen buying a physical counterfeit driver’s license so they can score some beer. But in the global criminal underworld, digital copies or scans of IDs are like a skeleton key. A convincing scan of an ID or utility bill, loaded with a bogus name or someone else’s identity, can unlock the ability to make bank accounts, bypass checks on cryptocurrency exchanges to buy or sell more Bitcoin, or rent a safehouse, all while keeping the criminal’s real identity hidden. The digitally altered IDs need to fool both human reviewers and automated systems that scan them for inconsistencies. Making fake IDs requires exquisite attention to detail. All of that manual labor doesn’t really scale, Nazarenko thought to himself as he meticulously edited passport after passport. He went on to make templates of fake identity documents that sped up the process, but it was still slow. After many of these nights, he had an idea. He built a website to automate the process that autopopulated a fake ID with the personal data a customer wanted, rather than having him do it by hand. Then, when generative AI became mainstream a short while later, he incorporated that too. “That gradually became OnlyFake,” Nazarenko told me. 💡 Do you know anything else about OnlyFake or AI fraud? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co. OnlyFake, the underground website Nazarenko made, landed like a bomb in the fraud world. It allowed anyone to generate not only convincing scans of driver’s licenses or passports, but also realistic looking photos of those fake identity documents laying on a sofa, carpet, or desk, as if someone had taken the ID out of their wallet and snapped a picture of it on their phone. Needed a convincing looking photo of a California driver’s license to open a cryptocurrency account in someone else’s name? Or a British passport to incorporate a company overseas? Or a Social Security card? No problem. The results were photos of identity documents that didn’t really exist, of people who may not be real, but yet could trick the sorts of people and companies that verify documents. With OnlyFake, you didn’t have to be a master forger like Nazarenko to make fake documents. Now, anyone could churn out fake IDs at scale, sometimes even hundreds or thousands at a time. OnlyFake threatened the entire idea of know-your-customer, or KYC, where financial institutions take steps to know who exactly are using its services. When anyone can make a photo of a fake ID for just a few dollars in Bitcoin, is anyone really who they say they are? Nazarenko didn’t know it then, hunched over his desk, but OnlyFake would soon become so influential that it would spawn copy cats, and the FBI would eventually hunt Nazarenko and shut down some of OnlyFake’s competitors. The Department of Justice said in an announcement about Nazarenko’s guilty plea that OnlyFake made more than a million dollars selling fake IDs which cost just $15 a pop. Now for the first time, Nazarenko, 28, free after a year in prison and living in Asia, is telling his story: how North Korean fake IT workers used his creation, how he ended up in ICE detention after serving his sentence in the U.S., and how OnlyFake unleashed a new age of AI-powered fraud. Nazarenko said he wanted to talk to me because I was the first journalist to reveal that OnlyFake existed. This article is based on interviews with Nazarenko and his lawyer, court records, and my own reporting in the online world of fraud that OnlyFake inhabited. “OnlyFake was the first time I saw how quickly a small internet project could turn into something global. Unfortunately, it also taught me, in a very painful way, what can happen when the scale of something grows faster than your understanding of its consequences,” Nazarenko told me. Growing up, Nazarenko’s parents questioned whether Nazarenko would ever find a job. His father worked for the Security Service of Ukraine. Raised in a suburb outside of Odesa, Nazarenko jumped between a few different gigs. He worked as a cook, a waiter, at a supermarket, and as a cameraman at a local Ukrainian TV station. Nazarenko also ran a YouTube channel about video games. Having a constant need for new graphics and thumbnails, he picked up Photoshop. Over the years, he got better and better. After searching for ways to make money, he discovered that people online would pay for high quality copies of identity documents. Nazarenko got into the business of fake IDs. “When you zoom in several hundred percent, you begin to understand how complicated even an ordinary passport or driver’s license really is. What looks like a simple plastic card to most people is actually made up of a huge number of small security and design elements,” he told me. Nazarenko said he hired programmers to start automating the generation of fake identity documents, including one hacker who “used to break into government websites.” He also hired designers; he said he met the workers through personal contacts and “online communities.” At first, OnlyFake didn’t use any AI. Automating parts of it was more about cutting out the busy work. Customers would fill out what name and other personal information they wanted to appear on the ID, upload whatever photograph they wanted, and OnlyFake would then automatically produce an image that looked like a scanned driver’s license or passport. Eventually, Nazarenko introduced more AI components. His team made a massive bank of fake, AI-generated faces that customers could place into the identity documents. For the backgrounds that the fake IDs would appear on, Nazarenko and his small team first photographed them themselves, then, “as neural networks advanced, we started generating them using AI,” Nazarenko said. The key to being able to generate all sorts of different IDs was obtaining lots of different scans. These showed what a Nevada driver’s license, or a Russian passport, or a U.S. passport card looked like, for example. Nazarenko put out a call to action on Telegram. If you have good scans of IDs, I will pay handsomely for them. And he was especially interested in U.S documents. Soon, Nazarenko had a huge library of fake IDs, stretching from Argentina to Spain. He fed these images into OnlyFake. “The era of rendering documents using Photoshop is coming to an end,” a post on OnlyFake’s Telegram account read. When Russia invaded Ukraine in 2022, Nazarenko left Ukraine and moved around Europe. Customers could buy individual generations of IDs, or sign up to various subscription plans. The ‘Light’ package for $99 a month gave a user 10 generations. The ‘Ultimate’ $1,500 tier, meanwhile, let a customer upload a spreadsheet of the personal data they wanted to appear on the IDs, making the process even faster, and even came with a direct customer support representative on Telegram. Nazarenko said other criminals were selling fish, while he “was selling the fishing rod.” Rather than paying a forger to make a fake ID, so a crimin