Counterfeit Cross-Border KYC Verification Platform: AI Face-Swapping to Steal Submitted Documents and Facial Videos for Impersonation Account Opening

Who Gets Targeted

The primary victim groups are cross-border sellers, indie developers, freelancers, and international students who are eager to complete real-name verification on overseas platforms. Unfamiliar with English KYC procedures or lacking overseas bank accounts and residential addresses, they are attracted by promises such as "fast approval" and "no need to appear in person," actively handing over their ID cards, passports, holding-ID photos, and live facial videos to so-called "proxy customer service agents." Fraudsters exploit information asymmetry and time anxiety: victims do not understand the true rules of legitimate KYC verification and worry that platform-imposed deadlines or rectifications will affect their account usage, making them highly cooperative during data submission and subsequent fee payment stages. These individuals generally lack awareness of the black and gray industry chains, realizing that they handed over their "digital identity" with their own hands only when the impersonated accounts are used for money laundering, fraudulent charges, or receive cross-border legal notices.

骗局怎么运作

• Criminal syndicates deploy "KYC proxy verification" phishing pages across developer communities, cross-border e-commerce groups, and Telegram channels. These pages impersonate the official styling of legitimate cross-border payment platforms, reusing their logos and copywriting. Fraudsters lure users into clicking phishing links with urgent wording such as "Official latest requirement, please complete verification as soon as possible, otherwise your account will be frozen," utilizing pressing language to lower users' vigilance regarding domain names. Believing they are interacting with official systems during this stage, users proactively fill out a full set of KYC materials.
• The fake page first requires basic information such as name, passport number, date of birth, and bank account details, followed by requests to upload front and back photos of ID cards and a photo of holding the ID card. The page deliberately replicates official verification steps—progress bars, form structures, and even error prompts closely mimic genuine procedures—causing victims to submit real data step by step during seemingly normal operations. Fraudsters also demand multiple rounds of reshooting under the excuse that "photos are blurry and rejected," thereby acquiring higher-resolution and multi-angle ID images.
• In the final step, the fake page pops up a "Please cooperate to complete liveness detection" window, demanding actions such as blinking, turning the head left and right, opening the mouth, and smiling, while prompting users to "ensure sufficient ambient lighting and bare head with ears exposed." This script is completely identical to regular platform facial liveness detection, making it difficult for users to detect anomalies. In the background, fraudsters collect high-definition facial video materials in real-time. This set of multi-angle dynamic footage serves as the core raw material for subsequently forging digital avatars via AI face-swapping, and is the most critical link of identity theft in the entire scam.
• Fraudsters input the collected ID photos and live videos into AI face-swapping tools to generate victims' exclusive digital avatars, and then use these avatars to remotely complete registration and account opening on overseas payment platforms, cryptocurrency exchanges, or bank sub-accounts. Because the forged videos are generated based on real liveness footage, dual verification of "liveness detection + identity comparison" on most facial recognition systems can be bypassed. At this point, the victim's true identity has been "swapped" into the overseas account system controlled by the criminal syndicate, and the impersonated account begins actual operations.
• After opening the impersonated account, fraudsters do not withdraw; instead, they continue to extort multiple rounds of fees from the victim using pretexts such as "deposit required for queuing up" or "system detected abnormal operation requiring unfreezing," harvesting a final batch of funds. Meanwhile, the accounts that have passed KYC are used to receive unidentified transfers, collect money laundering funds, or bind stolen credit cards. The victim's nominal identity is dragged into the criminal syndicate's financial chain, gradually becoming a link in the money laundering process.
• After completing the harvest, fraudsters quickly destroy their traces: phishing pages are taken offline, customer service accounts are deregistered, group chats are disbanded, and domain and server logs are cleared. Victims can neither recover the fees paid nor avoid cascading consequences such as cross-border accountability, bank risk-control freezes, and personal credit damage when the impersonated accounts are used for crimes. Because evidence collection involves overseas servers and multinational platforms, independent individual rights protection is extremely difficult, leaving most victims to passively wait for police special case investigations.

红旗信号（看到这些快跑）

• 🚩 Claiming "no need for personal appearance, guaranteed pass by submitting documents"—legitimate KYC mandates personal real-time cooperation, and any "proxy-pass" channel is abnormal.
• 🚩 Demanding "liveness videos" requiring specified actions like blinking, head shaking, and mouth opening, explained as "rigid platform risk control requirements"—such dynamic facial footage is the key raw material for AI face-swapping forgery.
• 🚩 Receiving ID cards, passports, and holding-ID photos via personal WeChat or Telegram private chats instead of encrypted uploads on official platforms—legitimate verification processes never operate this way.
• 🚩 Asking to delete chat history and enable burn-after-reading under the pretext of "channel sensitivity and confidentiality requirements"—this is a typical signal preparing to destroy evidence.
• 🚩 Continuously adding fee items: prepayments, deposits, activation fees, unfreezing fees, escalating layer by layer from small to large amounts.
• 🚩 Claiming to be "internal personnel" or "platform technical experts" yet unable to provide corporate entity information, formal contracts, or official authorization documents—both identity and qualifications cannot be verified.

真实案例

• Fuzhou's First Case of Illegal Account Authentication via AI Face-Swapping: According to Fuzhou News Network reports in March 2026, a court in Fuzhou sentenced a case involving illegal account authentication using AI face-swapping technology, where two involved individuals used AI face-swapping to substitute others' identities to complete account registration and verification, ultimately receiving prison sentences. This is the first local criminal judgment rendered against such AI face-swapping impersonation authentication behavior. (Source: [https://news.fznews.com.cn/fzyw/20260317/69b8a05c53e24.shtml](https://news.fznews.com.cn/fzyw/20260317/69b8a05c53e24.shtml))
• Cyber Police Crack AI Face-Swapping Case of Illegal Intrusion into Computer Information Systems: According to CCTV reports on September 20, 2025, public security cyber police cracked a case of illegal intrusion into computer information systems using AI face-swapping technology, arresting multiple criminal suspects. This case involved impersonating user identities via AI face-swapping to complete online platform facial verification and account registration, reflecting that AI face-swapping impersonation account opening has become a routine criminal modus operandi for the dark industry.
• College Student Uses AI Facial Forged Video to Steal 50,000 RMB: According to Hong Kong technology media ezone, a mainland college student used AI-generated dynamic facial videos to repeatedly bypass bank facial recognition systems over four months, stealing approximately 50,000 RMB from bank accounts. This case exposed the technical pathway of bypassing KYC facial verification using "live video footage + AI face-swapping," also illustrating that once facial videos recorded by users during the KYC process are leaked, they can become keys for impersonation theft.
• In June 2026, according to an investigative report by Xinhua News Agency, police in Jiaozhou, Qingdao, Shandong province cracked a dark industry case involving AI face-swapping fraud: criminals used AI technology to synthesize dynamic facial videos for false real-time authentication and fraud; police arrested 14 criminal suspects and seized over 50,000 AI-synthesized dynamic facial videos, with the syndicate having trafficked over 80,000 accounts and illegally profited over 600,000 RMB. (Source: [https://www.news.cn/fortune/20260622/930b1c07771b4603bb000be21fb2e870/c.html](https://www.news.cn/fortune/20260622/930b1c07771b4603bb000be21fb2e870/c.html))
• In March 2026, according to Fuzhou Evening News, the Jin'an District People's Procuratorate handled the city's first case of illegal account authentication via AI face-swapping: Li Moujia, a food delivery worker in Fuzhou who saw a part-time job advertisement in September 2025, used AI software to generate dynamic videos like blinking and nodding to simulate a real person passing facial liveness verification and completing account real-name registration, illegally authenticating 15 sets of payment accounts and assisting in transferring over 100,000 RMB in funds over a month. On March 11, 2026, the court sentenced Li Moujia to 8 months in prison and a fine of 7,000 RMB for the crime of illegally obtaining computer information system data. (Source: [https://news.fznews.com.cn/fzyw/20260317/69b8a05c53e24.shtml](https://news.fznews.com.cn/fzyw/20260317/69b8a05c53e24.shtml))

Official Stance

• In June 2026, the Department of Industry and Information Technology of Fujian Province published a thematic warning titled "Unveiling the Dark Industry Chain of AI Face-Swapping Fraud" in the special action column on "Combating and Governing Telecommunications Network New-Type Illegal Crimes," reminding the public to remain vigilant against video and voice verification and guard against AI face-swapping being used in identity authentication-type fraud.
• On June 22, 2026, Xinhua Net published a thematic report titled "Xinhua Investigation | Unveiling the 'AI Face-Swapping' Fraud Dark Industry Chain," exposing methods used by the dark industry to batch-register accounts and transfer funds using AI face-swapping, and prompting the public to strengthen facial information protection.
• On September 20, 2025, CCTV.com reported on "Cyber Police Crack Case of Illegal Intrusion into Computer Information Systems via 'AI Face-Swapping'," communicating the investigative progress of AI face-swapping impersonation account registration cases and alerting the public to the cross-platform and cross-regional investigation difficulties of such crimes.

How to Protect Yourself

• ✅ Complete KYC verification only under official platform apps or official website domains, reject any "verification links" pushed via SMS, email, or chat tools, and manually input domain names in browser address bars to verify before operating.
• ✅ Treat ID cards, passports, and facial videos as "financial keys," and never transmit original documents to any third-party proxy agencies or individuals; legitimate platforms will only require personal real-time authentication within encrypted sessions.
• ✅ Upon discovering phishing pages, take screenshots immediately to save evidence, report to official customer service of the involved platform and public security organs, and lodge complaints with domain registrars regarding domains used for fraud to prevent subsequent phishing.
• ✅ Enable bank account transaction SMS alerts and overseas transaction limit functions, regularly check whether unknown overseas payment accounts or credit records exist under personal names, and promptly freeze and apply for credit dispute resolution upon discovering abnormalities.
• ✅ Turn on security functions such as "secondary verification for overseas transactions" and "AI face-swapping interception" in WeChat Pay, Alipay, or anti-fraud center apps to raise the criminal cost of impersonated account opening.