Pain Point
Multiple independent 2026 investigations converge on the same finding: document-and-selfie KYC at crypto platforms is being defeated by injection attacks, not just forged documents.
Cato Networks researchers documented ProKYC, a toolkit sold for roughly $629 a year that generates a forged government document and a matching deepfake selfie video together — in its own demonstration, the tool defeated the verification flow of a major crypto exchange.
MIT Technology Review's April 2026 investigation found 22 public Telegram channels selling virtual camera injectors, deepfake generators, and camera-hooking modules from about $30, several explicitly naming which platforms their tools could bypass.
iProov's threat intelligence data shows native virtual camera injection attacks grew 2,665% year over year, with the technique overtaking simple presentation attacks (printed photos, masks) as the leading KYC bypass method since 2024.
Sumsub has reported AI-generated identity documents circulating for as little as $15 each — cheap enough that a single successful bypass, converted to crypto, covers the cost of dozens of failed attempts.
This is not a theoretical threat model. It's a documented toolchain, priced and sold openly, specifically built to defeat the document-and-selfie check most crypto platforms still treat as sufficient.
How It Works — The 7-Step Process
Identity verification for crypto platforms has to run all seven steps, with the two most-attacked steps carrying extra weight:
Data submission — the applicant provides identity information as part of onboarding, before wallet access is granted.
Document capture and authentication — document verification software checks authenticity features, catching the forged-document half of tools like ProKYC — NFC chip verification, where available, catches roughly 62% of synthetic-identity attempts that pass a purely visual check.
Data cross-check — extracted document data is matched against submitted information and trusted sources.
Biometric liveness and injection-attack detection — video verification software and id with liveness confirm a live, present applicant — critically, checking that the camera feed itself is genuine, not a virtual camera injecting a deepfake, which is the specific method behind 2026's fastest-growing bypass technique.
Risk signal enrichment — device and application-history signals flag when a document or device has appeared across multiple applications, a signature of coordinated fraud rather than an isolated attempt.
Automated decisioning — a composite score with reason codes routes the application to pass, review, or decline.
Ongoing re-verification — identity confidence continues after onboarding, rather than treating a clean sign-up as permanent clearance.
A verification process that only defends step 4 against a printed photo, and not against a virtual camera injecting synthetic video, is defending against 2023's attack while 2026's toolkits are already priced and in circulation.
Product Updates Worth Proposing (Crypto)
Deepfake and injection-attack resistant liveness — upgrading step 4 specifically to detect virtual camera injection, not just presentation attacks, closes the exact gap ProKYC and similar toolkits are built to exploit. This is the highest-leverage IDV update available right now, given how concentrated 2026's attack data is on this one method.
NFC chip verification at step 2, where the document supports it — a deterministic check against data the issuing authority actually signed, rather than a purely visual authenticity review, closes the document-forgery half of the attack chain independently of the video half.
Wallet Check as a second line of defense — even a synthetic identity that clears IDV still has to move funds somewhere. Continuous wallet risk scoring on deposit and withdrawal addresses catches illicit activity from an account that shouldn't have been onboarded in the first place, without depending on IDV alone to be the only checkpoint.
Travel Rule as a third, independent checkpoint — for VASP-to-VASP transfers, exchanging originator and beneficiary information under FATF Recommendation 16 means a counterparty platform's own identity data has to match, creating friction a document-and-video bypass at one platform doesn't automatically clear at the next.
False Positives
Responding to this threat by rejecting every application with an imperfect document scan or unusual lighting punishes real applicants for the same reason the fraud is hard to catch — the deepfakes are specifically engineered to look clean. Precision means detecting the injection and forgery signatures these toolkits actually leave, not treating every unfamiliar document format as suspicious.
Business Impact
Defense against the specific $30-to-$629 toolkit economy documented across multiple independent 2026 investigations.
A layered defense — IDV, wallet screening, and Travel Rule — so a bypass at one checkpoint doesn't mean unrestricted access to the rest of the compliance chain.
NFC-based document verification catching synthetic identities a visual-only check misses.
Ongoing re-verification closing the gap between a clean onboarding file and account activity months later.
How Finchecker Solves It
Finchecker's crypto identity verification combines document authentication, video verification with injection-attack detection, and continuous risk scoring — backed by wallet screening and Travel Rule compliance as independent checkpoints, so a platform isn't relying on IDV alone against 2026's deepfake toolkit economy.
Defend against $30 injection tools with more than a document-and-selfie check. Talk to Finchecker about identity verification, wallet screening, and Travel Rule for crypto platforms.