Digital Phantoms for Sale: The Rise and Fall of OnlyFake’s $1.2M Counterfeit Empire
A clandestine digital service capable of fabricating a passport from virtually any nation in mere minutes has ultimately led its architect to a New York courtroom. The defendant has formally pleaded guilty to orchestrating the illicit sale of over 10,000 forged digital identification credentials via the “OnlyFake” platform.
Prosecutors articulated that the perpetrator presided over an enterprise trafficking in counterfeit document imagery, prominently featuring passports and driver’s licenses. Furthermore, the accused conceded to participating in a conspiracy to commit identity fraud and the illicit exploitation of associated personal data.
OnlyFake provided its clientele with the illicit capability to forge digital facsimiles of United States identification, encompassing driver’s licenses across all fifty states, American passports, passport cards, and Social Security cards. The platform’s reach was sweeping, enabling the generation of passports for approximately fifty-six additional sovereign nations. Patrons were afforded the luxury of tailoring the file’s aesthetic, opting for either the pristine appearance of a scanned document or the casual realism of a photograph resting upon a desk. Transacting exclusively in cryptocurrency, the enterprise incentivized bulk acquisitions with lucrative discounts, purveying bundles of up to a thousand fabricated documents in a single transaction.
Investigative findings reveal that between 2021 and 2024, the illicit marketplace amassed hundreds of thousands of dollars in revenue, churning out no fewer than 10,000 counterfeit digital identities. Consequently, the defendant has consented to the forfeiture of his ill-gotten gains, an aggregate sum totaling $1.2 million.
Financial institutions and cryptocurrency exchanges universally mandate identity verification via government-issued documentation to establish accounts, a cornerstone of standard “Know Your Customer” protocols. Given that numerous financial entities accept photographic or scanned renditions of passports and driver’s licenses, OnlyFake effectively empowered malicious actors to circumvent these rigorous security audits and veil their true identities, thereby paving the way for money laundering and a myriad of other financial transgressions.
The 27-year-old orchestrator was apprehended by Romanian authorities and subsequently extradited to the United States in September 2025. Facing a maximum statutory penalty of fifteen years of incarceration, he awaits his final sentencing, which the court is scheduled to pronounce on June 26, 2026.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.