The Confessions of an AI Fraud Kingpin

A few years ago, Yuriy Nazarenko sat at a desk in his grandfather’s apartment in Ukraine and, on a diet of cigarettes, Lay’s chips, and beer, painstakingly made digital copies of fake identity documents. One of his four computer screens had the messaging app Telegram open. Another displayed a scan of a passport in Photoshop filling the entire monitor.

Pixel by pixel, with rap music blaring, Nazarenko edited each part of the passport. That included the MRZ codes, the block of text printed at the bottom of identity documents; the portraits to superimpose someone else’s face into the document; and the overall dimensions and quirks of each different type of passport. Nazarenko would sometimes sit for more than 12 hours at his computer, obsessively tinkering away, with a single, high-quality fake identity document taking up to a week of work.

When someone thinks of fake IDs, maybe they imagine a spotty underage teen buying a physical counterfeit driver’s license so they can score some beer. But in the global criminal underworld, digital copies or scans of IDs are like a skeleton key. A convincing scan of an ID or utility bill, loaded with a bogus name or someone else’s identity, can unlock the ability to make bank accounts, bypass checks on cryptocurrency exchanges to buy or sell more Bitcoin, or rent a safehouse, all while keeping the criminal’s real identity hidden. The digitally altered IDs need to fool both human reviewers and automated systems that scan them for inconsistencies. Making fake IDs requires exquisite attention to detail.

All of that manual labor doesn’t really scale, Nazarenko thought to himself as he meticulously edited passport after passport. He went on to make templates of fake identity documents that sped up the process, but it was still slow. 

After many of these nights, he had an idea. He built a website to automate the process that autopopulated a fake ID with the personal data a customer wanted, rather than having him do it by hand. Then, when generative AI became mainstream a short while later, he incorporated that too.

“That gradually became OnlyFake,” Nazarenko told me.

OnlyFake, the underground website Nazarenko made, landed like a bomb in the fraud world. It allowed anyone to generate not only convincing scans of driver’s licenses or passports, but also realistic looking photos of those fake identity documents laying on a sofa, carpet, or desk, as if someone had taken the ID out of their wallet and snapped a picture of it on their phone. Needed a convincing looking photo of a California driver’s license to open a cryptocurrency account in someone else’s name? Or a British passport to incorporate a company overseas? Or a Social Security card? No problem. The results were photos of identity documents that didn’t really exist, of people who may not be real, but yet could trick the sorts of people and companies that verify documents.

With OnlyFake, you didn’t have to be a master forger like Nazarenko to make fake documents. Now, anyone could churn out fake IDs at scale, sometimes even hundreds or thousands at a time. OnlyFake threatened the entire idea of know-your-customer, or KYC, where financial institutions take steps to know who exactly are using its services. When anyone can make a photo of a fake ID for just a few dollars in Bitcoin, is anyone really who they say they are?

Nazarenko didn’t know it then, hunched over his desk, but OnlyFake would soon become so influential that it would spawn copy cats, and the FBI would eventually hunt Nazarenko and shut down some of OnlyFake’s competitors. The Department of Justice said in an announcement about Nazarenko’s guilty plea that OnlyFake made more than a million dollars selling fake IDs which cost just $15 a pop.

Now for the first time, Nazarenko, 28, free after a year in prison and living in Asia, is telling his story: how North Korean fake IT workers used his creation, how he ended up in ICE detention after serving his sentence in the U.S., and how OnlyFake unleashed a new age of AI-powered fraud. Nazarenko said he wanted to talk to me because I was the first journalist to reveal that OnlyFake existed. This article is based on interviews with Nazarenko and his lawyer, court records, and my own reporting in the online world of fraud that OnlyFake inhabited.  

“OnlyFake was the first time I saw how quickly a small internet project could turn into something global. Unfortunately, it also taught me, in a very painful way, what can happen when the scale of something grows faster than your understanding of its consequences,” Nazarenko told me.

Growing up, Nazarenko’s parents questioned whether Nazarenko would ever find a job. His father worked for the Security Service of Ukraine. Raised in a suburb outside of Odesa, Nazarenko jumped between a few different gigs. He worked as a cook, a waiter, at a supermarket, and as a cameraman at a local Ukrainian TV station.

Nazarenko also ran a YouTube channel about video games. Having a constant need for new graphics and thumbnails, he picked up Photoshop. Over the years, he got better and better. After searching for ways to make money, he discovered that people online would pay for high quality copies of identity documents. Nazarenko got into the business of fake IDs.

“When you zoom in several hundred percent, you begin to understand how complicated even an ordinary passport or driver’s license really is. What looks like a simple plastic card to most people is actually made up of a huge number of small security and design elements,” he told me.

Nazarenko said he hired programmers to start automating the generation of fake identity documents, including one hacker who “used to break into government websites.” He also hired designers; he said he met the workers through personal contacts and “online communities.” At first, OnlyFake didn’t use any AI. Automating parts of it was more about cutting out the busy work. Customers would fill out what name and other personal information they wanted to appear on the ID, upload whatever photograph they wanted, and OnlyFake would then automatically produce an image that looked like a scanned driver’s license or passport.

Eventually, Nazarenko introduced more AI components. His team made a massive bank of fake, AI-generated faces that customers could place into the identity documents. For the backgrounds that the fake IDs would appear on, Nazarenko and his small team first photographed them themselves, then, “as neural networks advanced, we started generating them using AI,” Nazarenko said. 

The key to being able to generate all sorts of different IDs was obtaining lots of different scans. These showed what a Nevada driver’s license, or a Russian passport, or a U.S. passport card looked like, for example. Nazarenko put out a call to action on Telegram. If you have good scans of IDs, I will pay handsomely for them. And he was especially interested in U.S documents. Soon, Nazarenko had a huge library of fake IDs, stretching from Argentina to Spain. He fed these images into OnlyFake. 

“The era of rendering documents using Photoshop is coming to an end,” a post on OnlyFake’s Telegram account read. When Russia invaded Ukraine in 2022, Nazarenko left Ukraine and moved around Europe.

Customers could buy individual generations of IDs, or sign up to various subscription plans. The ‘Light’ package for $99 a month gave a user 10 generations. The ‘Ultimate’ $1,500 tier, meanwhile, let a customer upload a spreadsheet of the personal data they wanted to appear on the IDs, making the process even faster, and even came with a direct customer support representative on Telegram. Nazarenko said other criminals were selling fish, while he “was selling the fishing rod.” Rather than paying a forger to make a fake ID, so a criminal could then open a cryptocurrency account under a different name, OnlyFake let the criminals generate the IDs themselves.

It didn’t take long for customers to roll in. Nazarenko would then reinvest the money back into OnlyFake, including advertising his service, pushing development, and making the project bigger.

“At some point, I realized that what I was doing had almost stopped being design work. It had become a constant engineering problem,” Nazarenko said. Beyond making the documents was building infrastructure, automating it all, and keeping the site secure. “In practice, we started operating much like a normal technology startup, except we were operating in an illegal market,” he recalled. Later the Department of Justice said OnlyFake generated at least 10,000 fake IDs, and made $1.2 million over the years.

With customers also comes competitors. OnlyFake had identified a gap in the market for the automatic generation of fake identity documents in bulk, and other people wanted a slice of those profits. Nazarenko said competitors constantly fired distributed denial-of-service (DDoS) attacks at OnlyFake, where hackers bombard a site with so much bogus web traffic that it becomes unusable. Hackers also tried to access OnlyFake’s template database. A rival managed to unmask one of Nazarenko’s employees, and demanded certain concessions from OnlyFake, which Nazarenko says he denied. 

Nazarenko’s days were consumed with customers and orders; then nights were spent working on tweaking the documents. To stay up, he turned to coffee and energy drinks. Then cocaine.

With real money coming in, competitors hounding him, and the stress and paranoia that comes with that, Nazarenko started using other drugs to try to cope with the pressure, he said. He used LSD, magic mushrooms, and ecstasy. “That wasn’t about work anymore, it was about feeling something other than anxiety, about switching off a head that hadn’t switched off in years,” he said.

In early 2024, I discovered OnlyFake myself while scrolling through Telegram. I logged in, sent a small amount of cryptocurrency to the site, and generated some photos of fake IDs. I was blown away by the pictures of fake IDs laying on a carpet and upholstery. The implications for fraud were staggering, I thought. It seemed like it would shatter KYC practices — where cryptocurrency companies, for example, verify someone’s identity by having them upload a copy of their passport. What use is KYC when anyone can generate an identity document of essentially anyone else?

I entered the name David Creeks, put in a random birthday, and the site autofilled a bunch of other important information like the license’s issue and expiry dates. Just minutes later, I had photos of my California driver’s license laying on a rug. I made a British passport too.

After I made a couple of fake IDs with OnlyFake, I put them to the test. I successfully signed up for an account on OKX, a cryptocurrency exchange, using my fictitious ID. Former OKX employees later told me my test triggered a wave of changes inside the cryptocurrency exchange, who scrambled to make its systems more resilient to AI-generated IDs. (OKX did not respond to a request for comment for this story.)

While reporting that initial article, Abhishek Mathew, a cybersecurity researcher who followed the site’s growth, told me criminals were using OnlyFake to make bank accounts, or to unban their cryptocurrency accounts on Binance when asked for identification. 

At the time, I messaged the administrator of OnlyFake, who went by the handle John Wick. Only now do I know that to be Nazarenko. Nazarenko, by then living at an apartment in Poland, said the generated photos could be used to bypass verification on all sorts of other sites, including Airbnb, Coinbase, and Revolut. Nazarenko also said, unconvincingly, “using our site for the purpose of forging documents is prohibited.”

At the time, the article received a lot of attention from researchers in the fraud world, and the public saw for the first just how AI could supercharge the creation of fake IDs. 

With the article spreading, Nazarenko panicked. He deleted all of his personal emails, destroyed his laptop, and bought a new phone. He thought authorities would arrest him that very same day. 

Nazarenko also made an announcement on the OnlyFake Telegram channel to his customers, and anyone else who might have taken a sudden interest in the site: “The news says that our generator was used to forge documents. This is complete nonsense. This has never happened before. At a minimum, because it cannot be used to forge documents.”

Charitably, perhaps Nazarenko was positing a deeply philosophical point about truth and reality: how can these documents be forgeries if the documents don’t actually exist? Really, he was covering his ass, fully aware he was offering a service that enabled criminals, and had been for years. 

“At the time I hid behind ‘the client decides how to use it.’ That’s a convenient thing to tell yourself so you don’t have to look at the real picture,” Nazarenko told me later. He knew that the documents he was creating could be used by someone to drain another person’s account, or launder money, or hide who they really were while doing all sorts of damage, he said. 

After the article came out, the DDoS attacks against OnlyFake increased, Nazarenko said. He also received word that some very powerful people were taking advantage of his site.

On February 26, 2024, the United Nations wrote a letter to OnlyFake. It was on official UN letterhead, but OnlyFake, being a criminal enterprise, did not have a public office. So the UN sent a PDF of the letter to OnlyFake’s email account listed on the site.

“Dear Sir/Madam,” the letter, obviously not knowing who actually ran OnlyFake, started. “The Panel has received information that DPRK IT workers have utilized your service.”

The letter said that North Koreans had been using OnlyFakes to apply for remote work in the U.S.

As has been widely documented, thousands of North Koreans working for the regime got remote work jobs with U.S. companies, especially during the pandemic, and funnelled their wages back to North Korea to fund its nuclear weapon program. The UN letter said some of these workers were using OnlyFake to make fake IDs to sign up for freelance job sites, social media networks, and payment platforms. Alongside the country’s huge hacking campaigns against cryptocurrency exchanges, it was an ingenious way for North Korea to make more money.

The UN said it had information showing DPRK IT workers used OnlyFake to generate fake passports and driver’s licenses. Now, the UN wanted Nazarenko to hand over a ton of user data: a list of DPRK IT workers who had used OnlyFake; copies of all the documents OnlyFake had made for the DPRK; and what steps, if any, OnlyFake had taken to stop DPRK workers from using the site. (North Korean hackers recently stole $6.3 billion from cryptocurrency exchange Binance, in what is widely seen as one of the biggest hacks ever.)

The letter also addressed PassportCloud, a website that sold Photoshop templates of fake IDs and utility bills, and said North Koreans had used it to make fake bank statements and credit cards. I originally found OnlyFake after I first discovered PassportCloud and the sites appeared to be connected (one clue: it also used John Wick in its marketing). I asked Nazarenko multiple times if he was behind Passport Cloud too, but he never directly confirmed nor denied his involvement.

The UN demand was surreal to Nazarenko. He said he felt like he had only recently been working on a relatively small project. Now the UN was contacting him about how North Korean moles were probably using his service. He refused to give the UN anything, but looking back later, he said this is one of the first moments he realized he was in over his head. And for Nazarekno, it was about to get worse. A deeper threat was watching the growth of OnlyFake too: the FBI.

In May 2024, a few months after I published my article, a law enforcement agent working with prosecutors in the Southern District of New York went undercover. First, they bought a fake New York state identification card from OnlyFake, according to court records. Then they bought a fake U.S. passport card. Just over a week later, they purchased a New York state driver’s license and a U.S. passport. A couple of days later, they bought a fake Social Security card. OnlyFake, of course, happily provided all of these. OnlyFake’s customer support also told an undercover agent how best to use the fake IDs to circumvent KYC at cryptocurrency exchanges.

For someone who made a living protecting the identities of other criminals, Nazarenko had been very sloppy with his own security. When making the site and cashing out its proceeds, he sent Bitcoin to a cryptocurrency exchange account in his own name. Despite being a forger, he hadn’t bothered to make another identity.

It was trivial for authorities to identify who ran OnlyFake. Ukrainian authorities searched his parents’ house, Nazarenko said. Then on June 13, 2025, when Nazarenko flew to Bucharest, Romania, with his girlfriend for a friend’s birthday, the border officer took Nazarenko’s passport and spent an unusually long time looking at his computer. While being questioned in another room, authorities told Nazarenko there was a U.S. warrant out for his arrest. He was handcuffed, and for Nazarenko, everything “suddenly became very real.” Authorities seized some of OnlyFake’s servers too, Nazarenko said.

He spent three months in a Romanian prison before being extradited to New York. In Brooklyn’s Metropolitan Detention Center, prison officials transferred Nazarenko to another part of the facility when gang members assaulted him, according to a letter his lawyer later submitted in court. 

“I was building something that could be used to harm people, and I was making money from it. I did not fully understand that until I was sitting inside a concrete cell,” Nazarenko said.

Igor Litvak, Nazarenko’s lawyer, said Nazarenko offered to cooperate with the authorities, including providing potential customers’ information. Litvak said he even showed the UN’s letter to the FBI, which indicated the sort of person who used this platform. But prosecutors didn’t take Nazarenko up on his offer. The U.S. Attorney’s Office in the Southern District of New York acknowledged a request for comment but did not respond to an email asking why authorities didn’t enter a cooperation arrangement with Nazarenko.

This June, around a year after his initial arrest, a judge sentenced Nazarenko to time served of 12 months, a remarkably light sentence compared to the maximum penalty of 15 years in prison. Perhaps this was due in part to the fact that authorities did not identify any specific victims of OnlyFake — only that the site existed and it was used to make IDs. For much of his time in prison, OnlyFake continued to be up and running, just with its owner locked away, Litvak said.

That wasn’t the end of Nazarenko’s time in detention, though. As he prepared to leave the court room, thinking his lawyer would immediately drive him to the airport so he could self-deport, ICE officials detained Nazarenko. He spent another two months in detention. “It was much, MUCH worse than prison,” Nazarenko said, referring to having to sleep on the floor and people dying in the facility.

On August 17, Nazarenko was deported along with several other Ukrainians on a chartered flight. When he finally walked out of the airport in Poland, then was taken by land to Ukraine, he had only what he was holding. “Everything’s gone, and I’m still here,” he remembered thinking. Nazarenko said he was then taken to a military enlistment office and drafted for the war. He says he escaped, left Ukraine on foot, and then flew eventually to Thailand. 

OnlyFake spawned a bunch of copycat sites. The FBI targeted at least one and some of them have already shut down, but more keep springing up. In some ways, criminals don’t even need an underground site to make fake IDs. Researchers have used commercial AI chatbots to make photos of people holding up identity documents, although the main labs continue to put safeguards around their tech. And companies have bolstered their defenses against at least some AI-generated fake IDs, including those from OnlyFake during its lifespan, meaning they can detect signs the ID is fake even if it looks real to a person.

Now Nazarenko is working on an app, called TapMap, a social network and event finding app focused on Thailand that his lawyer brought up as evidence that Nazarenko won’t go into crime again. “For the first time in a long while, I had something I wanted a clear head for,” Nazarenko told me, referring to making the app and stopping drinking.

Nazarenko first sent me an email on August 21, just a few days after he was deported. When I asked him to send something to help verify he was the real Yuriy Nazarenko, he sent me a photo of his passport.

I used an online tool to figure out whether this was a genuine photo of his passport, or whether any part of it was AI-generated. Those tools said there was no evidence of AI manipulation.