While crypto exchanges tightened identity checks over the past several years, fraudsters adapted to those changes faster than most onboarding flows did. Forged IDs and recycled selfies have given way to real-time deepfakes, virtual cameras, and bypass kits sold on darknet markets. Here is how the tactics have evolved, who is using them, and where fraud teams should focus.
Why crypto remains a prime target
Fraudsters follow consumer trends closely, and crypto has stayed popular enough to keep them interested. Crypto now sits as the payment method with the highest attempted fraud rate in the Sift Global Data Network as of 2026.
The appeal comes down to speed and anonymity. A fraudster with stolen credentials or payment details can buy assets, move them quickly, and disappear. Crypto is also easy to launder. KYC is the front door between those fraudsters and the exchange, which is why so many of them work to get through it.
Fraudsters are not the only people trying. Our Trust and Safety Architect team found consumers on open forums trading KYC workarounds for their own reasons: some object to ID requirements on principle, some are minors who cannot legally trade, and others want to avoid tax obligations. Each of those users creates compliance exposure for the exchange, and the same workarounds are available to fraudsters.
Deepfakes and virtual cameras
When we first tracked this activity in 2021, the common tactics were forged driver’s licenses sold with matching selfies, digital face renderings built to pass live-video checks, and VPNs used to hide location. While those methods still circulate, there has been a major shift due to new technological advancements. Whereas fraudsters used to hold something fake up to a camera, they now skip the camera and instead push fake video straight into the verification flow.
Security researchers call this approach an injection attack: feeding false or manipulated material directly into systems instead of presenting a live person to a camera or sensor. iProov’s 2026 threat intelligence report found that injection attacks targeting iOS devices surged by 1,151% in the second half of 2025, contributing to a 741% annual increase.
The tooling is getting easier to find. In April 2026, Cointelegraph reported that a threat actor known as Jinkusu was allegedly selling tools that use deepfakes and voice manipulation to trick KYC verification at banks and crypto platforms. Cyvers CEO Deddy Lavid said the emergence of tools like this exposes real shortcomings in current KYC verification. The warning’s old news though, as back in May 2023 Binance’s chief security officer said that improving AI could defeat KYC checks using a single photo of the victim.
For fraud analysts, the practical lesson is that an active liveness prompt, such as turning your head or blinking, only proves something if the video comes from a real camera. Real-time deepfake tools can perform those prompted actions while streaming a synthetic face over a webcam feed. If your verification vendor cannot tell you how it detects injected video, treat that as an open risk.
Fraud-as-a-service and stolen identity packages
Fraud-as-a-service has matured alongside the tooling. We tracked fraudsters advertising to the fraud-curious on Telegram years ago, and professional scammers still offer to complete KYC on someone else’s behalf, using their own ID and face or a third party’s.
The iProov report adds a global angle, with it describing criminal groups in Southeast Asia that use virtual camera attacks and stolen KYC identity packages, with those methods later adopted in other regions, particularly Latin America. Southeast Asia saw a 720% spike in attacks in the third quarter of 2025, and iProov describes the region as a testing ground for emerging fraud techniques.
Tactics move quickly across the Fraud Economy. A method that works against one exchange gets packaged, sold, and tried against the next, so a technique showing up in another region today is a reasonable preview of what your team will see next.
VPNs and geographic workarounds
The oldest trick on the list still works often enough to matter. Forum guides we reviewed showed minors and fraudsters changing their IP addresses to countries with fewer crypto regulations, which can sidestep location-based KYC rules entirely.
IP geolocation alone can’t catch this. Compare it against the document’s issuing country, the device’s language and time zone settings, and the origin of the payment instrument. Mismatches across those signals tell you more than any single one of them.
How fraud teams can respond
KYC remains necessary. Exchanges rely on it to stay compliant, and it keeps legitimate, of-age customers moving through onboarding. It works best as one layer in a broader defense. Here are some practical steps:
- Ask about injection detection. Request evidence of how your identity verification provider detects virtual cameras and injected video, not just printed photos or masks.
- Red-team your own flow. Test onboarding with virtual camera software and synthetic documents on a recurring schedule, and fix what gets through.
- Look past the selfie. Device, network, and behavioral signals add evidence that sits outside the face image. Sift assesses thousands of signals across the user journey and aggregates them into a Sift Score from 1 to 100, where 1 is trustworthy and 100 is likely fraud, updating in real time as behavior changes.
- Keep evaluating after onboarding. An account that clears KYC can still be used for cash-out, so evaluate risk at login, deposit, and withdrawal as well as signup.
- Watch for linked accounts. Fraudsters who buy identity packages often reuse devices, networks, and payment details across accounts. Connections between accounts can surface before any single account looks suspicious.
Combined with an ML-powered approach to trust and safety, this layered setup stops fraudsters at signup and at every transaction without slowing down legitimate customers.
If you’d like to learn more about how Sift can help your team tackle crypto or KYC verification-related fraud, read more here.
Frequently asked questions
What is a KYC injection attack?
An injection attack feeds manipulated or synthetic video, images, or documents directly into a verification system instead of showing a live person to a camera or sensor. Fraudsters commonly use virtual camera software so a deepfake appears as ordinary webcam input.
Can liveness detection stop deepfake KYC bypass?
It depends on what the check examines. Checks that only evaluate the image on screen can miss video that never came from a real camera. Stronger setups verify the capture source and pair identity verification with device, network, and behavioral signals.
Why do legitimate consumers try to bypass KYC?
A legitimate consumer might try to bypass KYC because of objections to identification requirements, being under the legal age to trade, or avoiding tax obligations. Exchanges still need to treat these attempts as compliance risk, since workarounds shared publicly are available to fraudsters too.
