An underground market is targeting one of digital finance’s core trust mechanisms
MIT Technology Review reports that scammers are using illicit tools sold on Telegram to bypass the identity checks used by banks and crypto platforms, especially “Know Your Customer” or KYC facial scans. In its investigation, the publication identified 22 public Chinese-, Vietnamese-, and English-language Telegram channels and groups advertising bypass kits and stolen biometric data. The tools are presented as ways to get around compliance systems that are supposed to confirm both that an account belongs to a real person and that the user’s face matches the identity documents originally submitted.
The implications are serious because KYC checks are foundational to how digital finance screens for fraud, mule accounts, and money laundering. If those checks can be commoditized into something sold openly through messaging channels, then what appears to be a security layer may increasingly function as a market opportunity for criminal specialists. The story is not just about one clever exploit. It is about a supply chain for identity evasion.
The reporting grounds that concern in a vivid example. A scammer working from a money-laundering center in Cambodia demonstrates a Vietnamese banking app asking for a photo tied to the account and then a video liveness check. Instead of using a legitimate live camera feed, the scammer uses a mismatched image and still passes. According to the investigation, this is possible because many bypass kits replace the expected live camera stream with other videos or images through a virtual camera technique.
The weakness lies in how “liveness” can be faked at the device level
The key technical point in the supplied text is that the tools typically do not defeat biometric systems by perfectly imitating a real user at the platform level. Instead, they compromise the phone operating system or app environment so that the camera feed itself can be swapped out. Once a liveness check accepts a fake input as if it were real-time video, the rest of the security process can collapse.
That matters because many users assume facial checks are inherently stronger than passwords or basic document uploads. In principle, they often are. But the MIT Technology Review reporting shows how their effectiveness depends heavily on the integrity of the device and application pipeline. If scammers can control what the app sees, then the face check may become less a biometric safeguard than a presentation test vulnerable to tooling and fraud services.
The investigation says these kits claim to target institutions ranging from major crypto exchanges such as Binance to banks including Spain’s BBVA. Some channels had thousands of members or subscribers. Even if not every claim in those channels is valid, the scale of advertising described in the source material suggests a mature enough market to merit concern.
Financial crime is becoming more service-oriented
One striking feature of the reported Telegram ecosystem is how explicitly it is marketed. The story describes channels advertising “all kinds of KYC verification services” and presenting themselves as secure and professional. That language is revealing. It suggests a criminal economy that increasingly mimics legitimate software and outsourcing businesses. Instead of requiring every fraud ring to invent its own methods, specialists can sell turnkey bypass capabilities into a larger illicit network.
This service model increases the systemic risk. When fraud techniques become standardized products, they spread faster, reach less technically sophisticated actors, and become harder to contain through one-off countermeasures. Banks and exchanges may improve one layer of defense only to find that a new package is already for sale teaching operators how to route around it.
The investigation also points to the cat-and-mouse dynamic already familiar across financial security. As institutions deploy more advanced onboarding and verification steps, criminals adapt. What makes this round more consequential is that the adaptation directly targets biometric trust systems that many companies have treated as an upgrade path.
Why this matters beyond crypto or one region
Although the reporting includes examples tied to Cambodia, Vietnamese banking apps, and global crypto exchanges, the core issue is not geographically narrow. Any institution that relies heavily on phone-based identity verification should pay attention. If public groups can openly market tools for bypassing biometric checks, then the threat is broader than any single app or country.
The significance also extends beyond immediate fraud losses. KYC systems underpin anti-money-laundering compliance, account integrity, and the ability to link digital activity to real individuals. Weakening those systems means making it easier to open mule accounts, move illicit funds, and create new layers of distance between criminal organizers and the money itself.
MIT Technology Review’s reporting does not imply that KYC is pointless. It does show that compliance technologies are only as strong as the surrounding device controls, fraud detection, and operational skepticism supporting them. Financial institutions may need to treat biometric onboarding less as a solved problem and more as one component in a continuously contested security environment.
The most important lesson is that identity verification is now a live battleground with commercialized attack tools. That shifts the question from whether bad actors can bypass KYC to how cheaply, how openly, and how often they can do it. On the evidence presented here, the answer is concerning enough to force a rethink.
This article is based on reporting by MIT Technology Review. Read the original article.
Originally published on technologyreview.com
