ProKYC: Deepfake KYC Bypass — Threat and Defense 2026

ProKYC is an AI tool discovered by researchers at Cato Networks (report dated October 9, 2024), sold in cybercriminal circles and designed to bypass KYC verification on crypto exchanges and financial platforms. It generates fake identity documents and deepfake videos of nonexistent people to pass facial recognition and liveness checks during registration. According to Cato, the annual subscription costs about $629, and in a demo the tool bypassed verification on the Bybit exchange. This is part of the phenomenon known as New Account Fraud (NAF) — the mass creation of fraudulent accounts.

By 2026, the threat has been recognized at the regulatory level: FATF (December 2025) and WEF Cybercrime Atlas (January 2026) explicitly name deepfakes as a tool for bypassing AML controls, and AI identity fraud has grown by hundreds of percent year over year. This article is about the threat and defense, not promotion and not instructions. Using such tools is a criminal offense (fraud, document forgery, money laundering). Here we explain how the threat works, real-world cases, how exchanges and users defend themselves, and what consequences follow.

IMPORTANT DISCLAIMER: This article is intended solely for informational and educational purposes and is designed to raise awareness of cyber threats. It is NOT an advertisement for the tool, does NOT contain instructions on how to obtain or use it, and does NOT encourage any unlawful activity. Creating fake IDs, bypassing KYC, opening accounts under a fictitious or another person’s identity, and laundering funds are serious criminal offenses in most countries around the world (including Ukraine, the EU, and the US), punishable by imprisonment. The purpose of this material is to help users, businesses, and compliance teams understand the threat and protect themselves from it.

What You Need to Know About ProKYC and Deepfake KYC Bypass

• Cato Networks detected — Cato CTRL report dated October 9, 2024
• What it does: generates fake IDs + deepfake videos of nonexistent people to pass KYC
• Model: sold as a subscription (~$629/year according to Cato) in the cybercriminal underground
• Target of attacks: crypto exchanges (Bybit in the demo), and, according to the seller, payment platforms as well
• Type of fraud: New Account Fraud (NAF) — creation of fraudulent accounts
• 2026 scale: AI identity fraud has grown by hundreds of % YoY; attacks on identity systems occur every few minutes
• Regulators: FATF (Dec. 2025) and WEF (Jan. 2026) have officially recognized deepfakes as an AML threat
• Defense is evolving: next-generation liveness, injection protection, document forensics
• Legally: use = criminal offense (fraud, forgery, money laundering)

Main takeaway: ProKYC is not a “life hack,” but a marker of a new era of fraud, where “seeing no longer means believing”. Understanding this threat is essential both for ordinary users (to avoid becoming victims of identity theft) and for businesses (to protect onboarding).

What is

To understand the threat, let’s start with the basics.

What is KYC

KYC (Know Your Customer) — “know your customer” — is a required identity verification procedure during registration on financial platforms: crypto exchanges, banks, and payment services. It usually includes:

• Uploading a document (passport, ID, driver’s license)
• A selfie or video selfie
• Matching the face in the selfie with the photo in the document
• Liveness check — confirming that there is a live person in front of the camera, not a photo/recording

KYC is the foundation of AML (anti-money laundering). Exchanges and banks are required by law to carry it out.

More details on how biometric verification works are in our article KYC and biometrics.

What is ProKYC

ProKYC is a malicious AI tool that, according to Cato Networks, is sold to cybercriminals to bypass this very procedure. Instead of buying stolen or fake documents on the dark web, a fraudster uses such a tool to generate a completely fabricated identity — a fake document and a deepfake video of a nonexistent person.

The key difference from older methods is that real (stolen) data used to be required. Now the identity is created “out of thin air” by generative AI.

History

The threat became publicly known thanks to researchers’ work.

Cato Networks report (October 2024)

On October 9, 2024, Cato CTRL (the research arm of Cato Networks) published a report on the discovery of ProKYC. Cato’s chief security strategist Etay Maor described the tool as a “new level of sophistication” in financial fraud.

What the demonstration showed

In the report, Cato showed how the tool is used to create:

1. Fake identity document with a fictitious name
2. Accompanying deepfake video and photo of a generated “person”

In the demonstration, this setup was used to pass KYC on the Bybit exchange (registered in Dubai). According to Cato, the tool even offered a choice of which platform the verification was being “tailored” for.

Context: why this matters

This happened after five years of growing cooperation between crypto exchanges and regulators. U.S. authorities have brought charges against executives of major exchanges for AML violations — so exchanges have significantly tightened verification. Tools like ProKYC are a direct attack on these hard-won security measures.

How it works

Let’s break down the mechanics of the threat conceptually — so you understand what to defend against. (No operational details — this is not an instruction.)

Two components of the attack

The threat of bypassing KYC with deepfakes is usually built on two elements:

1. Synthetic document — an AI-generated fake ID with fabricated data and a photo
2. Face deepfake — a video/image of a non-existent person synchronized with the document, capable of imitating movements for liveness checks

Why older systems are vulnerable

Verification systems designed in 2015-2022 were tested against simple threats: printed photos, masks, video replays. But generative AI has changed the attack surface faster than most systems have had time to adapt.

Experts identify two main categories of modern attacks:

• Face-swap / synthetic faces — replacing or generating a face
• Injection attacks (camera injection) — feeding a synthetic video signal bypassing the camera, directly into the verification system

Key problem: a simple liveness check confirms that “something is moving,” but does not confirm that the video signal is authentic, that the capture path has not been intercepted, or that the content was not generated by a model.

Asymmetry of the race

Researchers note a troubling asymmetry: a fraudster can create a new method for generating synthetic faces in a couple of days, while a KYC vendor updates its detection model on a much longer cycle. During this “window,” fraudulent accounts are created.

Cases

Let’s look at abuse scenarios so that businesses and users understand the threat surface. This is a description of threats, not a guide.

1. New Account Fraud (NAF) — mass fraudulent accounts

The main scenario. Attackers create multiple accounts under fictitious identities. Why:

• Abuse of sign-up bonuses (welcome bonus abuse, airdrop farming)
• Creating “multi-accounts” for manipulation
• Bypassing limits and bans

2. Money laundering (money laundering)

Accounts under fake identities are used as “strawmen” to funnel illicit funds — a direct AML threat. That is why FATF and financial regulators are sounding the alarm.

3. Sanctions evasion

Sanctioned individuals or entities (including, according to researchers, state-backed hacking groups such as North Korea’s Lazarus) may use fake identities to access financial infrastructure and bypass restrictions.

4. Terrorist financing

Anonymous accounts under fictitious identities are a channel for illicit cross-border transfers of funds.

5. Account Takeover (hijacking someone else’s accounts)

A separate threat: deepfakes are used not only for new accounts, but also for taking over existing ones — impersonating the face/voice of a real user or executive to pass checks and initiate unauthorized transfers.

6. Expansion into traditional finance

Although such tools initially target crypto exchanges, experts warn that similar techniques can be used against banks and payment platforms. This makes the threat systemic for the entire financial sector.

It is important to understand: each of these scenarios is a crime behind which there are real victims: users who have been robbed, legitimate businesses suffering losses, and society as a whole (money laundering, sanctions, terrorism).

Why it is dangerous

Who this threat affects and how.

For crypto exchanges and fintechs

• Direct losses from fraud and chargebacks
• Regulatory fines for AML/KYC failures (millions of dollars)
• Reputational damage
• Arms race — ongoing costs to strengthen security

For ordinary users

• Identity theft — your leaked documents can be used to create fraudulent accounts
• Account takeover — hijacking your existing accounts through deepfake
• Indirect risks — if the exchange suffers losses or comes under regulatory sanctions, all of its clients are affected

For the entire system

• Undermining trust in digital identity
• Weakening AML — a channel for money laundering and financing crime
• “Reality gap” — a world where synthetic media are indistinguishable from real ones

Scale

Figures and regulatory signals in 2026.

Recognition at the regulatory level

• FATF (December 2025, Horizon Scan) — explicitly identifies deepfakes as a tool capable of bypassing AML controls, CDD systems, and digital identity verification during onboarding. Calls for a standardized risk-based approach
• WEF Cybercrime Atlas (January 2026) — the study examined 17 face-swap tools and 8 camera-injection tools; most were able to bypass standard biometric onboarding checks

Threat Statistics

• AI identity fraud grew by hundreds of percent year over year (by various estimates, up to 700% YoY)
• In 2024, identity systems faced a deepfake attack roughly every 5 minutes
• Digital document forgeries increased by 244% over the year
• Gartner predicted that by 2026, 30% of companies would stop trusting autonomous biometric verification systems — and that has already become a reality
• Deloitte: about 26% of executives had already reported incidents involving deepfake fraud

Figures show that this is not an isolated tool, but a systemic shift in the threat landscape. ProKYC is just one of many and a vivid symptom.

Business Protection

How exchanges, banks, and fintech companies protect themselves in 2026. (Useful if you are launching a project with onboarding.)

Multi-layered protection (defense in depth)

Experts agree: a single liveness check is not enough. You need a “layered cake”:

1. Document forensics — analysis of IDs for signs of AI generation and forgery
2. Next-generation liveness — active and passive liveness checks resistant to deepfakes
3. Protection against injection attacks — blocking the delivery of a synthetic signal that bypasses the camera (at the camera input level, not after capture)
4. Behavioral analysis — behavior patterns that are atypical for a legitimate user
5. Biometric binding — linking biometrics to a verified identity, not just “the face is live”
6. Manual review — human oversight for suspiciously “perfect” images/videos
7. Watchlist matching — checks against databases of serial fraudsters

Key principles

• Liveness ≠ identity — “liveness” proves that a person is real and present, but does not prove who they are. A complete flow links the document + live face + matching
• Balance — overly strict systems produce many false positives, while overly lenient ones let fraud through (a dilemma noted by Cato’s Etay Maor)
• Continuous updating — detection models must be updated as quickly as attacks evolve

Detection providers (2026 market)

The market has seen the emergence of specialized solutions for detecting deepfakes in KYC (Sumsub, Onfido/Entrust, iProov, Veriff, Jumio, Incode, etc.), integrated via API into KYC/AML pipelines. This is a separate, growing “shield” industry.

If you are launching a fintech or an exchange, budget for modern anti-deepfake protection from day one. This is a 2026 requirement, not an option.

User protection

What can an ordinary person do to avoid getting hurt.

Protect your documents

• Don’t hand out passport scans — every leak of your documents can be used to create a fraudulent account in your name
• Do not send document photos to dubious services, chats, or “verifiers” out of nowhere
• Check who you give KYC to — only official, regulated platforms

Protect your accounts

• Enable 2FA through an authenticator app (not SMS) everywhere
• Unique passwords + a password manager
• Monitor notifications about logins and transactions
• Act quickly on any suspicious activity

Recognize deepfake scams

Deepfakes are also used directly against ordinary people:

• Fake “celebrity” videos promoting crypto “investments” are a classic scam. If Elon Musk is “giving” you bitcoin in a video, it’s a scam
• Deepfake calls “from a boss/family member” asking you to urgently transfer money
• Romance scam with deepfake video

If your data has been leaked

1. Check for breaches (haveibeenpwned and similar services)
2. Change your passwords and enable 2FA
3. Notify banks/exchanges of a possible compromise
4. If your identity has been stolen, contact law enforcement

More about protection against fraud — in our materials on security and KYC biometrics.

Legal consequences

This is the most important section. Let’s be absolutely clear.

Using such tools is a crime

Creating fake documents, bypassing KYC, and opening accounts under a fictitious or someone else’s identity are serious criminal offenses in most jurisdictions:

• Document forgery
• Fraud (fraud)
• Money laundering (money laundering)
• Identity theft (identity theft)
• Violation of AML/CFT legislation

Penalties

Depending on the jurisdiction and scale — heavy fines and real prison sentences. Financial crimes involving fake identities are prosecuted especially harshly because they are linked to money laundering, sanctions, and the financing of crime.

In Ukraine

Forgery of documents, fraud, and money laundering are criminal offenses under the Criminal Code of Ukraine. In addition, after the legalization of crypto (2026) and accession to international standards, oversight of such operations is being tightened.

Global trend

FATF and national regulators are tightening oversight specifically of deepfake threats. The digital trail of such operations (blockchain analytics, logs, KYC records) makes anonymity illusory — exposure is only a matter of time.

Conclusion: even if it technically seems like you “got away with it,” the legal and reputational consequences are catastrophic and long-lasting. This is not an area where it is worth risking your freedom.

The Future

Where the “shield and sword” race is heading.

Escalation on Both Sides

• Attack: deepfakes are becoming cheaper, more accessible, and more realistic
• Defense: detection is moving toward multi-modal analysis, protection against injections, and cryptographic identity binding

Protection Trends 2026-2028

• Cryptographic verification of media provenance (C2PA, content credentials)
• Multifactor biometrics (face + iris + behavior)
• Tamper-evident records — signed, immutable verification logs
• AI vs. AI — detectors trained on new attacks in real time
• Regulatory pressure — required anti-deepfake standards

What This Means

The threat will not disappear, but protection is not standing still either. The platforms that treat identity verification as a continuous process, rather than a one-time check at registration, will come out on top.

For the average user, the takeaway is simple: use regulated platforms that invest in security, and protect your data. For businesses, build modern protection into the architecture.

Frequently Asked Questions FAQ

What is ProKYC?

ProKYC is an AI tool discovered by Cato Networks researchers (report dated October 9, 2024) that is sold in cybercriminal circles to bypass KYC verification on crypto exchanges and financial platforms. It generates fake identity documents and deepfake videos of nonexistent people to pass facial recognition and liveness checks. It is a tool for committing fraud (New Account Fraud), not a legitimate service. Using it is a criminal offense.

Is it legal to use ProKYC or similar tools?

No, absolutely not. Creating fake documents, bypassing KYC, and opening accounts under a fictitious or stolen identity are serious criminal offenses: document forgery, fraud, money laundering, identity theft, and violations of AML laws. Penalties include heavy fines and real prison terms. This applies to Ukraine, the EU, the US, and most countries. This article is a warning about the threat, not a guide.

Who discovered ProKYC?

The tool was discovered and described by Cato Networks (its research division, Cato CTRL) in a report dated October 9, 2024. Chief Security Strategist Etay Maor described ProKYC as a “new level of sophistication” in financial fraud. In the demonstration, the tool was used to bypass KYC on the Bybit crypto exchange.

How do deepfakes bypass KYC checks?

Conceptually, the threat is built on two elements: an AI-generated fake document and a deepfake video of a nonexistent person capable of mimicking movements for a liveness check. Older verification systems (2015-2022) were tested against simple threats (printed photos, masks) and are vulnerable to synthetic faces and injection attacks, where the video signal is fed in bypassing the camera. A simple liveness check confirms movement, but not the authenticity of the signal.

Which exchanges are at risk?

According to researchers, such tools target crypto exchanges (in Cato’s demo — Bybit). Experts warn that similar techniques can also be applied to traditional banks and payment platforms. This is a systemic threat to the entire financial sector. At the same time, major regulated exchanges are actively strengthening defenses (next-generation liveness, document forensics, behavioral analysis).

How large is the deepfake fraud threat in 2026?

Very large. AI identity fraud has grown by hundreds of percent year over year (estimates put it at up to 700%). In 2024, identity systems faced a deepfake attack roughly every 5 minutes. FATF (December 2025) and the WEF Cybercrime Atlas (January 2026) officially recognized deepfakes as an AML threat. Gartner predicted that by 2026 most companies would stop trusting standalone biometrics — and that has become reality.

How do exchanges and fintech companies protect themselves from deepfakes?

Through layered defense: document forensics (detection of AI forgeries), next-generation liveness (deepfake-resistant), protection against injection attacks (blocking synthetic signals at the camera input), behavioral analysis, biometric binding (linking biometrics to identity), manual review of suspicious cases, and matching against fraud databases. The key principle: liveness proves that a person is alive, but not who they are — a full flow is needed.

How can an ordinary user protect themselves?

Protect your documents (don’t hand out passport scans, provide KYC only to regulated platforms), protect your accounts (2FA via an app, unique passwords, login monitoring), and recognize deepfake scams (fake videos of “celebrities” with crypto “gifts,” deepfake calls “from the boss”). The universal rule for 2026: seeing more does not mean believing — verify urgent money requests through an independent channel.

What should I do if my documents may have leaked?

Check for leaks through services like haveibeenpwned, change passwords and enable 2FA on all financial accounts, notify banks and exchanges about a possible compromise, and contact law enforcement if there are signs of identity theft. The faster you respond, the lower the risk that your data will be used for fraudulent accounts.

Can a deepfake take over my existing account?

Yes, this is a separate threat — account takeover. Face or voice deepfakes are used to impersonate a real user when passing checks and initiating unauthorized transfers. Protection: strong 2FA (hardware keys or an authenticator app), activity monitoring, and caution with video/voice “confirmations.” If someone asks you “by video” to urgently transfer money, verify it independently.

Does this threat also affect traditional banks?

Yes. Although tools like ProKYC initially targeted crypto exchanges, experts warn that the same techniques can be applied to banks and payment platforms that use biometric onboarding. Regulators (FATF) are urging the entire financial sector to strengthen defenses. Banks are implementing anti-deepfake detection in their KYC processes.

Is this an instructional article on how to bypass KYC?

No. This is an educational piece about a cyber threat — what it is, how large it is, how to defend against it, and what consequences follow from using it. There are no operational details on obtaining or using such tools. The goal is to help users and businesses understand and neutralize the threat. Using KYC-bypass tools is a criminal offense.

Conclusion

ProKYC is not a “tool” to look for, but a threat to understand. Its emergence, documented by Cato Networks, marked a new era of fraud, where generative AI makes it possible to create fake identities “out of thin air.” In 2026, this is already a systemic problem for the financial industry recognized by FATF and the WEF.

Key takeaways:

✅ ProKYC — an AI tool for deepfake KYC bypass, discovered by Cato Networks (Oct. 2024)
✅ The threat is real and massive — AI fraud growth of hundreds of % YoY
✅ The goal — New Account Fraud, money laundering, sanctions evasion
✅ Regulators (FATF, WEF) officially recognized the threat in 2025-2026
✅ Business protection — layered (forensics, liveness 2.0, anti-injection)
✅ User protection — safeguard documents, 2FA, skepticism toward “videos”
🚫 Use = criminal offense (fraud, forgery, laundering)

For the average user, the main takeaway is this: the era of “seeing means believing” is over. Protect your documents, enable 2FA, use regulated platforms, and be skeptical of any urgent requests for money — even if they come with “live video.”

For businesses (if you are launching a fintech or exchange): modern anti-deepfake protection is not optional, but a 2026 necessity. First-generation liveness checks are no longer enough.

And most importantly: tools like ProKYC are created by criminals for crimes. Behind the apparent “tech sophistication” are real victims — robbed people, legitimate businesses, and the erosion of trust in digital identity verification. Using such tools does not lead to “easy money,” but to criminal liability and ruined lives. Knowing about this threat is needed for one thing only — to protect yourself from it.

Also read our security materials: KYC and biometrics, how to protect yourself from crypto fraud, and reviews of reliable wallets Trust Wallet and MetaMask.