Yuriy Nazarenko spent years sitting in his grandfather’s apartment in Ukraine, editing digital passport scans for twelve hours at a time. He worked on a diet of cigarettes, Lay’s chips, and beer, manually adjusting MRZ codes and superimposing faces onto documents pixel by pixel. A single high-quality fake identity could take a week to produce.
While a typical fake ID might be a physical driver’s license bought by a teenager, digital copies serve a different purpose in the criminal underworld. These files act as skeleton keys, allowing users to open bank accounts, bypass cryptocurrency exchange checks, or rent safehouses without revealing their real identities. The documents must fool both human reviewers and automated scanning systems.
Nazarenko realised that manual labour did not scale. He built a website to automate the process, filling forms with customer data instead of hand-editing each file. When generative AI became mainstream, he integrated it into the platform.
“That gradually became OnlyFake,” Nazarenko told me.
OnlyFake launched as a major threat to the fraud market. The site generated convincing scans of driver’s licenses and passports, as well as realistic photos of these documents resting on sofas or desks. Users could order a California driver’s license to open a crypto account or a British passport to register a company overseas. The results were images of documents and people that did not exist but could still deceive verification systems.
The platform removed the need for a master forger. Anyone could produce hundreds or thousands of fake IDs quickly. This undermined know-your-customer protocols, where financial institutions verify user identities. When a fake ID photo costs just a few dollars in Bitcoin, the reliability of such checks is compromised.
Nazarenko did not foresee the immediate impact of his work. OnlyFake soon spawned copycats, and the FBI eventually hunted him down to shut down competitors. The Department of Justice stated in an announcement that OnlyFake generated over a million dollars selling IDs that cost $15 each.
Nazarenko, now 28, is free after serving a year in prison and currently lives in Asia. He is sharing his story for the first time. He explained that North Korean fake IT workers used his creation. He also ended up in ICE detention after serving his sentence in the U.S.
“OnlyFake was the first time I saw how quickly a small internet project could turn into something global,” Nazarenko said. “Unfortunately, it also taught me, in a very painful way, what can happen when the scale of something grows faster than your understanding of its consequences.”
Images provided by Nazarenko show the scope of his work.
Growing up, his parents questioned whether he would ever find employment. His father worked for the Security Service of Ukraine. Nazarenko, raised in a suburb outside Odesa, held various jobs including cook, waiter, supermarket worker, and cameraman for a local Ukrainian TV station.
He also ran a YouTube channel about video games. The constant need for new graphics led him to learn Photoshop. After searching for income sources, he discovered that online users would pay for high-quality copies of identity documents.
“When you zoom in several hundred percent, you begin to understand how complicated even an ordinary passport or driver’s license really is,” Nazarenko said. “What looks like a simple plastic card to most people is actually made up of a huge number of small security and design elements.”
Nazarenko hired programmers to automate the generation of fake documents, including one hacker who “used to break into government websites.” He also hired designers through personal contacts and online communities. Initially, OnlyFake did not use AI. Automation focused on cutting busy work. Customers uploaded a photograph and entered personal details, and the system produced an image resembling a scanned license or passport.
Eventually, Nazarenko introduced more AI components. His team created a large bank of fake, AI-generated faces for users to place into identity documents. For backgrounds, Nazarenko and his team first photographed real surfaces, then, “as neural networks advanced, we started generating them using AI,” Nazarenko said.
The ability to generate varied IDs relied on obtaining many different scans. These showed how a Nevada driver’s license, Russian passport, or U.S. passport card looked. Nazarenko posted a call to action on Telegram, offering payment for good ID scans. He was especially interested in U.S. documents. Soon, he had a huge library of fake IDs stretching from Argentina to Spain.
“The era of rendering documents using Photoshop is coming to an end,” a post on OnlyFake’s Telegram account read. When Russia invaded Ukraine in 2022, Nazarenko left Ukraine and moved around Europe.
Customers could buy individual generations or subscribe to plans. The ‘Light’ package cost $99 a month for 10 generations. The ‘Ultimate’ tier cost $1,500 and allowed users to upload a spreadsheet of personal data, speeding up the process and including a direct customer support representative on Telegram.
Nazarenko said other criminals were selling fish, while he “was selling the fishing rod.” Criminals could generate IDs themselves rather than paying a forger to create a document for a specific purpose.
Customers arrived quickly. Nazarenko reinvested the money back into OnlyFake, funding advertising, development, and expansion.
“At some point, I realized that what I was doing had almost stopped being design work. It had become a constant engineering problem,” Nazarenko said. Beyond creating the documents, he built infrastructure and kept the site secure. “In practice, we started operating much like a normal technology startup, except we were operating in an illegal market,” he recalled. The Department of Justice later stated OnlyFake generated at least 10,000 fake IDs and made $1.2 million over the years.
Customers also brought competitors. OnlyFake had identified a gap in the market for bulk automatic generation of fake identity documents, and others wanted a share of the profits. Competitors constantly launched distributed denial-of-service (DDoS) attacks, bombarding the site with bogus traffic to make it unusable. Hackers also attempted to access OnlyFake’s template database. A rival managed to unmask one of Nazarenko’s employees and demanded concessions, which Nazarenko denied.
Nazarenko’s days were consumed with orders, while nights were spent tweaking documents. To stay awake, he used coffee and energy drinks. Then cocaine.
With real money coming in, competitors hounding him, and the stress and paranoia that came with that, Nazarenko started using other drugs to cope with the pressure. He used LSD, magic mushrooms, and ecstasy.
