Counterfeit documents on the darknet: pixels, paper and the KYC bypass trade
The darknet's document trade sells two very different things. One is digital: identity documents rendered on demand as images, made to satisfy the upload step of a remote check. The other is physical: laminated cards and bound passports shipped in envelopes, built to survive being examined in person. Both lines of business exist for the same reason — a large slice of the digital economy still onboards customers by asking for a photo of an identity document.
Pixels: document images for remote checks
The digital variant drew wide attention in February 2024, when 404 Media reported on OnlyFake, a service selling generated identity documents at $15 each. The site claimed its "neural networks" could turn out up to 20,000 documents a day, in bulk from a spreadsheet, and a reporter's sample was convincing enough to pass the automated identity check of the crypto exchange OKX. "The era of rendering documents using Photoshop is coming to an end." — OnlyFake announcement on its Telegram channel, quoted by 404 Media
Paper: physical forgeries by post
Physical fakes are the older and arguably more consequential trade. In May 2026, a French-led operation with Spanish police and Europol dismantled a workshop in Alicante producing forged European identity and administrative documents using what Europol described as industrial-scale production methods. Around 800 forged documents were seized, and the suspect is alleged to have run an online marketplace offering documents in both physical and digital form to customers across Europe. Open sources give a rough price ladder. Privacy Affairs' 2023 Dark Web Price Index listed fake US driver's licences at around $220, identity cards from about $150, a fake US green card at $250, and passports at $1,500 (US) to $3,500 (EU). Physical documents cost more than images because they have to carry security features that survive handling; the digital ones only need to pass a screenshot inspection. The template scene
How are these produced? Resistant AI, a document-fraud detection firm, examined OnlyFake and found little evidence that whole documents were generated end-to-end. It described layered templates instead: a background, a template layer, machine-readable zones, hologram renderings, and AI-generated portraits and signatures combined into a convincing whole. The service refused to sell PSD files to protect its templates, cycled between domains, and distributed through private Telegram channels. Craft in this scene means consistency — printed data, machine-readable zone and barcode have to agree with each other — and on North American licences that includes the stacked PDF-417 barcode on the back, the machine-readable format used on identification documents. Full generative models still struggle to keep those zones coherent, according to the analysis. What KYC pressure does
Demand follows the architecture of remote onboarding. Crypto exchanges, rental platforms, betting sites and banks ask new users to photograph a document, sometimes alongside a selfie; where that check is the gate, document images are the crowbar. The study in Security Journal of counterfeits across eleven darknet markets between January 2014 and September 2015 found that forgeries — money, coupons, identity documents — made up roughly six percent of estimated sales volume, the second-largest revenue category in its sample. Worth separating from this trade are dumps of genuine scans: leaked images of real licences sold in bulk are a different product with a different harm, and they say more about how verification data is stored than about forgery skill. Enforcement, mainly European
Enforcement treats document fraud as infrastructure crime. In July 2025, Greek, German and US authorities with Europol and Eurojust raided an Athens "travel agency" that worked as a distribution hub for forged documents, arresting eight people and dismantling a fully equipped forgery lab: hundreds of counterfeit documents, passport components, biometric data sets, two high-end laser printers and over EUR 68,000 in cash, with customers said to include migrant-smuggling networks and drug traffickers. The Alicante workshop followed in May 2026. Europol's 2025 serious and organised crime assessment frames document fraud as a key enabler of other crime, and INTERPOL maintains the shared detection layer: a database of lost and stolen travel documents, reference tools holding images of genuine documents, and a forensic laboratory that dissects new forgeries. A slow arms race
The quality race is real but grinding. Workshops buy better printers and components; detectors respond by comparing submissions against each other — repeated backgrounds, lighting and lens geometry give batch production away — and by checking documents for internal consistency rather than trusting lookups of the extracted data alone. Border forces cross-check seized papers against shared databases in real time, as Europol officers did during the Athens raids. Resistant AI's verdict on full generative production was cautious: rendering whole documents with coherent holograms, zones and typography remains hard, but the gap narrows each year. None of this changes the structure of the market. Documents are sold where everything else is sold — marketplaces, autoshops and Telegram channels — and when one storefront falls, the vendors move. The arrest of the alleged OLVX market administrator in North Macedonia showed the same pattern one layer up: infrastructure gets policed, demand stays. As long as onboarding amounts to a photo of a document, both trades have customers.
