```
Criminals seeking to defeat Know Your Client (KYC) checks no longer need specialist skills — they can simply buy their way past them. An investigation published by BleepingComputer, drawing on research from threat intelligence firm Flare, describes an underground market for identity verification services that has matured into something resembling a legitimate software business: tiered pricing, product bundles, refund guarantees, and dedicated customer support.
That commercial polish matters. It signals industrialised volume rather than opportunistic, one-off forgery — a supply chain that treats KYC as a solvable engineering problem rather than a barrier.
An escalation ladder, from static fakes to live humans
The catalogue of services Flare documented climbs a clear escalation ladder. It begins with forged identity document images — cheap, disposable, and adequate for static document-upload checks. Buyers then move to deepfake face-swap video packages designed to satisfy liveness prompts during remote onboarding.
At the top of the ladder sits the most disruptive offering: human stand-ins. Verified agents complete genuinely live verification sessions on the buyer's behalf, presenting their own faces to the camera while the account is registered to someone else's stolen or synthetic identity.
The services do not end at onboarding. Sellers also supply guidance for maintaining fraudulent accounts afterwards — how to stay below anti-money-laundering monitoring thresholds, keep device and IP usage consistent, and handle re-verification prompts without tripping controls.
Why existing checks are losing ground
Three structural shifts explain why these services are proliferating. Remote onboarding became the default during the pandemic and, in most markets, never retreated — so a growing share of all verification happens through a screen. The cost of producing high-fidelity face-swap video has collapsed to consumer-grade hardware and open models. And breaches continue to leak biographical data, letting fraudsters build fakes that are consistent with what a checking database will return.
The central consequence for defenders is uncomfortable: liveness detection is now the layer under active attack, and live agents defeat it precisely because the session is genuinely real. The camera sees a living human being. The check passes. No artefact-hunting heuristic will catch it.
Institutions handling high volumes of remote or virtual onboarding simply see more verification attempts daily than their original control designs anticipated. That is a structural exposure, not a regulatory shortcoming — and it applies equally to any market where onboarding moved to a screen and stayed there.
What defenders should do
The implication is that a passed KYC check must be treated as one signal among several, not as proof of identity. Practically, that shifts the defensive focus from onboarding-time checks to post-onboarding monitoring:
- Treat KYC as the start of monitoring, not the end. Behavioural analytics — device fingerprint stability, session geography, funding and withdrawal patterns, and mule-account clustering — is the primary defence against live-agent bypasses, because the fraud only becomes visible after the account starts moving value.
- Layer document forensics with independent data sources. Verify against issuing authorities, telco or credit records, and government datasets rather than relying on the document image alone.
- Assume video injection is in scope. Challenge liveness vendors on their resistance to replayed and real-time deepfake streams, not just static photo spoofing. For the lower tiers of the escalation ladder — re-recorded screens and pre-rendered face-swaps — the familiar artefact checks still apply: moiré patterns from re-recorded displays, implausible reflections, and inconsistent hair or teeth edges. The top tier, where the impersonator sits in front of the camera themselves, defeats those heuristics entirely.
- Treat rejections as intelligence. Bulk or clustered onboarding attempts from correlated attributes are a leading indicator of a campaign.
- Watch the criminal forums. Listings that name your institution are an early warning that your onboarding flow is being marketed as a target.
Identity verification has become an adversarial, commoditised marketplace. Any institution treating a passed KYC check as proof of identity is relying on a control that the underground economy has already priced.
```
意圖繞過「認識你的客戶」（Know Your Client，KYC）檢查的罪犯，如今已不需要專業技術——他們只需付費即可通過檢查。BleepingComputer 公布的一項調查，引用威脅情報公司 Flare 的研究，描述了一個身份驗證服務的地下市場，該市場已發展成熟，儼如一家正規軟件企業：分層定價、產品捆綁、退款保證，以及專屬客戶支援。
這種商業化包裝意義重大。它顯示這是工業化規模的運作，而非投機性、一次性的偽造行為——一條將 KYC 視為可解決的工程問題、而非障礙的供應鏈。
逐步升級的階梯：由靜態偽造到真人替身
Flare 所記錄的服務目錄，呈現一條清晰的升級階梯。開端是偽造的身份證明文件影像——便宜、用完即棄，足以應付靜態文件上傳檢查。買家其後會轉向 deepfake 換臉視像套裝，專門用來應付遠程開戶過程中的人臉活體（liveness）驗證提示。
階梯頂端是最具破壞性的服務：真人替身。已驗證的代理人會代買家完成真正實時的驗證會話，鏡頭前展示的是他們自己的面容，而帳戶則以他人被盜或合成的身份註冊。
服務並不僅限於開戶階段。賣家亦會提供日後維持詐騙帳戶的指引——如何避開反洗錢監控閾值、維持裝置與 IP 使用的一致性，以及在觸發風險管理機制之前應對重新驗證提示。
為何現有檢查節節敗退
三項結構性轉變解釋了此類服務為何大行其道。疫情期間遠程開戶成為主流，在大多數市場從未回落——因此越來越多驗證環節都在屏幕後面完成。製作高保真換臉視像的成本，已降至消費級硬件和開源模型即可應付的水平。與此同時，數據外洩持續洩露個人背景資料，令騙徒得以構建與核查數據庫回傳資料相符的偽造身份。
對防守方而言，核心結果令人不安：活體檢測（liveness detection）如今正是被積極攻擊的防線，而真人替身之所以能擊敗它，正因為該會話是真實的——鏡頭看到的是一個活生生的人。檢查通過。任何尋找偽影的啟發式方法都無法識別。
處理大量遠程或虛擬開戶的機構，每日面對的驗證嘗試，必然遠超其原有控制設計的預期。這是結構性風險暴露，而非監管缺陷——對於任何開戶流程轉移到屏幕並長期停留的市場，情況同樣適用。
防守方應如何應對
其啟示在於：通過 KYC 檢查必須被視為多項訊號之一，而非身份證明。實際上，防禦重心應由開戶時檢查轉向開戶後監控：
- 將 KYC 視為監控的起點，而非終點。 行為分析——裝置指紋穩定性、會話地理位置、資金存取模式，以及傀儡帳戶聚類——才是對抗真人替身繞過的主要防禦手段，因為詐騙只有在帳戶開始轉移資金後才會顯現。
- 將文件鑑證與獨立數據源結合。 應向簽發當局、電訊商或信貸紀錄以及政府數據庫作交叉核實，而非僅依賴文件影像。
- 假設視像注入攻擊在威脅範圍之內。 應向活體驗證供應商質詢其抵禦重播及實時 deepfake 串流的能力，而不只是靜態照片欺騙。對於升級階梯中較低的層級——重新錄製的屏幕及預先渲染的換臉——既有的偽影檢查仍然有效：重新錄製顯示屏產生的摩爾紋（moiré patterns）、不合理的反光，以及頭髮或牙齒邊緣的不一致。至於頂層，冒充者親自坐在鏡頭前，這些啟發式方法完全失效。
- 將拒絕個案視為情報。 由相關屬性觸發的大量或集中式開戶嘗試，是攻擊行動的先行指標。
- 監察犯罪論壇。 提及你所屬機構的貼文，是你的開戶流程已被列為目標推廣的早期警告。
身份驗證已演變成一個對抗性、商品化的市場。任何將通過 KYC 檢查視為身份證明的機構，依賴的是一項地下經濟早已為其定價的控制措施。