MetaFraud KYC Scam - Fake AI Verification Notices Imitating Cross-Border Payment Companies to Steal Merchant Deposits

Who Gets Targeted

Victims are primarily small and medium-sized merchants operating on cross-border e-commerce platforms, independent websites, or third-party acquiring institutions, especially foreign trade merchants in Southeast Asia, South Asia, and the Middle East. These merchants heavily rely on cross-border payment channels in their daily operations, making them sensitive to KYC verification processes and fearful of account freeze risks. Scammers exploit merchants' anxiety to restore collection functions and their worry that funds will be withheld by platforms, setting urgent deadlines in forged verification notices to drive merchants into skipping verification steps through official channels due to anxiety. Some merchants are more easily deceived by AI-generated, highly realistic notice documents due to a lack of ability to recognize official notification formats from payment platforms or language barriers preventing them from directly contacting platform customer service.

骗局怎么运作

• Scammers first acquire store information, registration emails, and partial transaction data of cross-border merchants via the dark web or scam toolkits, using web crawlers or data breach sources to lock onto active merchants using specific cross-border payment services. They then impersonate well-known cross-border payment companies or acquiring institutions by registering email addresses highly similar to official domains, preparing for subsequent phishing notifications.
• Using AI image generation models and text generation models, scammers produce KYC verification notification emails whose format, logo, color scheme, and styling are highly consistent with official ones. The notification content typically claims that the merchant account has abnormal transactions or incomplete identity information, requiring supplemental verification within 24 to 48 hours, otherwise funds will be frozen or collection channels closed. The layout, wording, and even customer service signatures of the email mimic official styles, making it difficult for merchants to discern authenticity from appearance alone.
• The verification link attached to the notification directs to a fake KYC verification page, which also uses AI-generated interface assets and requests merchants to fill in sensitive information such as business licenses, legal representative IDs, and bank account details. After the merchant submits the information, the page enters a fake verification progress stage, informing the merchant that they must first pay a deposit or verification guarantee, typically ranging from hundreds to thousands of US dollars, with a promise of a refund after successful verification.
• When merchants raise questions about the deposit requirement, scammers arrange for fake customer service personnel to communicate via WhatsApp or Telegram. These agents use AI voice synthesis or preset script templates to urge merchants to pay as soon as possible, citing reasons such as changes in platform risk control policies or compliance upgrades of funding channels. Some scripts also threaten that if payment is not made on time, the previously submitted information will be reported to financial regulatory authorities, impacting their subsequent business operations.
• Once the merchant transfers the deposit, scammers continue secondary or even tertiary scams under pretexts such as failed verification, required additional guarantees, or account unfreezing fees. By the time the merchant realizes they have been scammed and contacts the real payment platform, the scammers have long since closed or switched the collection channels. Because the involved payment platforms are registered overseas, merchants often find it difficult to hold them accountable, and the submitted ID and bank details may be resold for secondary crimes or account takeover.

红旗信号（看到这些快跑）

• 🚩 Notification emails require merchants to pay a deposit, verification guarantee, or unfreezing fee; legitimate payment platforms never charge such fees for KYC verification.
• 🚩 The sender's email address has subtle differences from the official domain, such as an extra letter, similar-looking characters, or a non-official top-level domain.
• 🚩 The notification imposes intense deadline pressure, demanding completion within 24 to 48 hours under threat of freezing accounts or funds.
• 🚩 The web address of the verification link does not match the official platform, and while the page looks visually similar, it lacks official security certificates or trusted indicators.
• 🚩 Customer service requests communication through unofficial channels such as WhatsApp or Telegram and uses threatening language when urging transfers.

真实案例

• In 2026, police in Mawana, Uttar Pradesh, India, cracked down on a fake Paytm KYC scam and arrested 3 suspects. The gang impersonated official Paytm communications via phone calls and phishing links to send KYC update notices, inducing users to download remote control software and drain bank account funds. This is a relatively typical case among publicly reported KYC scams in 2026; although it does not involve cross-border payment companies, the methodology matches the pathway of forging KYC notices in this scam. (Source: [https://www.bhaskar.com/local/uttar-pradesh/meerut/mawana/news/mawana-cyber-fraud-arrest-fake-paytm-kyc-scam-138941556.html](https://www.bhaskar.com/local/uttar-pradesh/meerut/mawana/news/mawana-cyber-fraud-arrest-fake-paytm-kyc-scam-138941556.html))
• In April 2026, dark web threat actor Jinkusu sold an AI deepfake toolkit on a forum, integrating InsightFace real-time face-swapping and voice modulation modules specifically designed to bypass KYC verification at cryptocurrency exchanges and banks. The emergence of this toolkit enables non-technical scam syndicates to batch-generate highly realistic KYC verification materials, providing a technological foundation for cross-border payment merchant scams. (Source: [https://cointelegraph-cn.com/news/ai-cybercrime-tool-crypto-bank-kyc-deepfakes](https://cointelegraph-cn.com/news/ai-cybercrime-tool-crypto-bank-kyc-deepfakes))
• In September 2026, identity verification service provider Shufti Identity released a report indicating that organized fraud rings are systematically attacking new merchant onboarding and KYC review processes of digital enterprises using deepfake technology and reused identity information. The report mentions multiple cross-border payment and e-commerce platforms encountering such attacks, with some merchants defrauded of deposits after receiving forged verification notices, though specific monetary amounts were not disclosed on a case-by-case basis.
• In August 2026, according to CNR reports, the Kuaishou Security Center assisted relevant authorities in dismantling a cybercrime gang masquerading as Kuaishou platform customer service to commit fraud: the gang pretended to be official Kuaishou customer service, falsely claiming that the platform launched paid promotional package services to provide merchants with traffic boosting, customer acquisition, and account unfreezing services. The operation arrested a total of 38 criminal suspects, among whom 18 were subjected to criminal coercive measures. (Source: [https://tech.cnr.cn/techph/20260805/t20260805_527748590.shtml](https://tech.cnr.cn/techph/20260805/t20260805_527748590.shtml))
• In August 2026, the Hejiang Police Station in Chengdu High-Tech Zone solved a typical new AI fraud case: a suspect used AI tools to replicate and modify a forged payment screenshot worth 30,000 yuan, committing fraud based on this AI-forged 30,000 yuan payment screenshot. Police successfully apprehended and brought the suspect to justice in another region. (Source: [https://view.inews.qq.com/a/20260807A0EO3J00](https://view.inews.qq.com/a/20260807A0EO3J00))

Official Stance

• In 2026, police in Mawana, Uttar Pradesh, India, issued an advisory regarding the fake Paytm KYC scam, reminding the public that any calls and links demanding money transfers or the installation of remote control software through KYC updates are scams.
• In September 2026, Shufti Identity issued a risk advisory via Benzinga, pointing out that organized fraud rings are utilizing deepfake technology to attack digital enterprise KYC processes, recommending that businesses upgrade multi-factor authentication and liveness detection.
• The National Anti-Fraud AI Platform guided by the Criminal Investigation Bureau of the Ministry of Public Security of China emphasized in its public notices that any KYC notifications requesting transfers to personal accounts or overseas accounts under the guise of verification, unfreezing, or deposits are scams, and merchants should verify through the message center within the official payment platform app or website.

How to Protect Yourself

• ✅ Upon receiving any KYC verification notice, merchants should avoid clicking links in emails or text messages, and instead log directly into the official app or website of the payment platform to verify pending review matters in the backend message center or customer service page.
• ✅ KYC verification on payment platforms will never require merchants to pay deposits, guarantees, or unfreezing fees to any account; any such requests should be directly judged as scams and reported.
• ✅ Manually check sender email addresses and link domains, watching out for anomalies such as spelling approximations, character substitutions, or non-official top-level domains. When unconfirmed, contact and verify inversely through the platform's official customer service phone number or email address.
• ✅ Enable two-factor authentication for cross-border payment accounts, regularly check account login devices and operation logs, and immediately freeze the account and contact the platform risk control team upon discovering abnormal logins or unauthorized operations.