The forger speaks: how OnlyFake sold AI-generated fake IDs for $15

What it's about

On November 5, 2026, US tech outlet 404 Media published a long profile of Yuriy Nazarenko, the man behind OnlyFake, an underground website that used generative AI to produce fake IDs automatically. In it, the 28-year-old Ukrainian talks publicly for the first time about his service, his arrest, jail in New York, the immigration detention that followed and his life today in Thailand. 404 Media says the piece draws on interviews with Nazarenko and his lawyer, court records and its own reporting inside the fraud scene. The author was also the first journalist to expose OnlyFake, back in early 2024. That, Nazarenko says, is why he reached out to him of all people.

From Photoshop forger to "a startup in an illegal market"

It all started in his grandfather's apartment in Ukraine. There, Nazarenko edited scanned passports pixel by pixel in Photoshop: the MRZ lines (the machine-readable text zone at the bottom of an ID), the portrait photos and every quirk of each document type. One high-quality fake could take up to a week. He had originally taught himself Photoshop to make thumbnails for his gaming YouTube channel. Before that he had worked as a cook, a waiter, a supermarket employee and a camera operator.

Manual work doesn't scale, so he built templates first and then a website that filled in IDs automatically with whatever details customers wanted. He hired programmers for the job, including, he says, a hacker who used to break into government websites, plus designers. To offer as many document types as possible, he bought scans of real IDs on Telegram, especially American ones. The result was a library stretching from Argentina to Spain.

As generative AI took off, more pieces fell into place: a large database of AI-generated faces that customers could drop into documents, and AI-generated backgrounds. The output wasn't just scans. It looked like phone photos of IDs lying on a couch, carpet or desk, which is exactly the format banks and crypto exchanges ask for during online identity checks.

"Other criminals sold fish, I sold the fishing rod."

That's how Nazarenko describes his business model. Customers could buy single IDs or subscribe. The "Light" plan cost $99 a month for 10 generations. The "Ultimate" tier cost $1,500 and let customers upload a spreadsheet of personal data and generate IDs in bulk, with personal support on Telegram. He says he ran the project "like a normal tech startup, just in an illegal market." Competitors hit the site with DDoS attacks (flooding a website with so much fake traffic that it stops working) and tried to steal the template database. Nazarenko speaks openly about stress, paranoia and drug use, from energy drinks to cocaine, LSD and ecstasy.

Why OnlyFake threatened identity verification

At the heart of this is KYC ("Know Your Customer"): the rule that financial services have to verify who their customers are, often by having them upload a photo of their ID. In the criminal world, 404 Media says, a convincing digital fake is "like a master key." It opens bank accounts, crypto accounts or rental agreements without revealing your real identity.

The reporter tested this himself in early 2024. He typed in the made-up name "David Creeks" and a random date of birth, and the site filled in the issue and expiry dates on its own. Minutes later he had a California driver's license "on a carpet" and a British passport. He then used the fake to open an account at the crypto exchange OKX. Former OKX employees later said the test set off a wave of internal changes to harden the company's systems against AI-generated IDs. Security researcher Abhishek Mathew said at the time that criminals were using OnlyFake to open bank accounts or unlock suspended Binance accounts. Nazarenko himself, then going by the alias "John Wick," also named Airbnb, Coinbase and Revolut as possible targets, while insisting that forgery was "prohibited" on the site.

Mail from the UN: North Korean IT workers as customers

On February 26, 2024, a UN panel of experts sent a letter to OnlyFake's email address. It said North Korean IT workers had used the service to create fake passports and driver's licenses for freelance platforms, social networks and payment services. The background: thousands of North Koreans, especially during the pandemic, have used false identities to land remote jobs at US companies and funneled their salaries to the regime, which uses the money to fund its nuclear program among other things. The UN asked for a list of North Korean users, copies of every document made for them and details of any countermeasures. Nazarenko handed nothing over. But he says that was the moment he realized the whole thing was getting away from him.

The letter also named PassportCloud, a site selling Photoshop templates for IDs and invoices that appeared to be linked to OnlyFake. Asked several times, Nazarenko wouldn't say whether he was behind it too.

FBI, arrest and a light sentence

In May 2024, an undercover agent working with the US Attorney's Office for the Southern District of New York bought a New York ID card, a US passport card, a driver's license, a US passport and a Social Security card, one after another. Customer support even explained how to use them to get past crypto exchanges' KYC checks.

The forger, of all people, got sloppy with his own cover. He sent Bitcoin earnings to an exchange account in his real name. On June 13, 2025, he was arrested on arrival in Bucharest, held in Romania for three months and extradited to New York. His lawyer says gang members attacked him at the Metropolitan Detention Center in Brooklyn. The lawyer, Igor Litvak, says Nazarenko offered to cooperate, customer data included, but prosecutors didn't take him up on it. They didn't answer when asked why.

In June 2026 he was sentenced to 12 months, which he had already served. The maximum was 15 years. 404 Media suspects one reason is that the authorities didn't identify any specific victims. According to Litvak, OnlyFake kept running for much of the time he was locked up. Right after sentencing, immigration agency ICE took him into custody. He describes two months in immigration detention as "much, MUCH worse than prison." He was deported on August 17. In Ukraine, he says, he was drafted into the military, fled on foot and now lives in Thailand, where he's working on an events app called TapMap.

The bigger picture

The story is a textbook case of how generative AI industrializes fraud. What used to take a specialist a week of manual work became a mass-market product for $15. According to 404 Media, OnlyFake has spawned plenty of copycats. The FBI has gone after at least one, some have vanished and new ones keep appearing. Researchers have also shown that commercial chatbots can generate photos of people holding IDs, even though the big labs build in safeguards. On the other side, companies have improved their detection and can now spot some AI fakes, OnlyFake's included, by traces humans can't see.

Some caveats remain. Much of the profile rests on Nazarenko's own account, including his remorse, his escape and his fresh start. The fairly light sentence and the rejected offer to cooperate raise questions. So does the bigger lesson: a photo of an ID is becoming less and less useful as proof of identity. The article's ending says it all. When Nazarenko was asked to prove who he was, he sent a photo of his passport, and the reporter ran it through an online tool that checks for AI manipulation. It found none.