From a money-laundering center in Cambodia, a scammer demonstrates how easily modern banking security can be defeated. On a smartphone running a Vietnamese banking app, he uploads a stolen photograph, then bypasses a “liveness” facial check using a static image and a virtual camera tool. After a brief delay, the system approves the login. The technique, documented in a video shared with researcher Hieu Minh Ngo, reflects a growing underground economy of illicit software designed to defeat identity verification systems.
According to a recent investigation by MIT Technology Review, such tools are now widely sold across Telegram channels and groups that openly advertise ways to bypass Know Your Customer (KYC) checks used by banks and cryptocurrency exchanges. Researchers identified nearly two dozen channels operating in Chinese, Vietnamese, and English, many offering “bypass kits,” deepfake-enabled camera tools, and stolen biometric data. These services are marketed as turnkey solutions for opening fraudulent accounts and laundering illicit funds.
KYC systems are meant to ensure that a person opening or accessing an account is physically present and matches the identity on file. But scammers have increasingly turned to “virtual camera” technology, which replaces a phone’s live video feed with pre-recorded footage or manipulated imagery. In practice, this allows criminals to present stolen faces or AI-generated deepfakes as if they were real-time users passing security checks.
The result is a fast-evolving cat-and-mouse game between financial institutions and cybercriminal networks. As banks strengthen biometric authentication, underground developers refine their tools. Some kits described on Telegram can jailbreak phones, while others inject malicious code into banking applications to trigger fake camera inputs. These methods are increasingly used to open “mule accounts” that serve as temporary holding points for stolen funds.
The scale of the ecosystem is significant. Telegram channels identified in the MIT Technology Review investigation sometimes have thousands of members and openly advertise compatibility with major institutions, including global crypto exchanges and large commercial banks. Although Telegram has removed some of these groups, new ones continue to appear, reflecting the platform’s role as a persistent marketplace for illicit services.
This surge in bypass technology is closely tied to the expansion of “pig-butchering” scams, a global fraud model in which victims are tricked into transferring money or crypto to criminal networks. According to blockchain analytics firm Chainalysis, billions of dollars are stolen annually through such schemes, with losses continuing to rise year after year. Once funds enter the system, KYC bypass tools help criminals move and launder money rapidly across multiple accounts and platforms.
Financial institutions targeted in these schemes acknowledge the challenge. Exchanges such as Binance, along with banks like BBVA and digital banking platforms such as Revolut, have stated they are aware of attempts to circumvent their security systems. They argue that such attacks are an industry-wide issue and that they continue to improve safeguards. However, independent security researchers suggest that undetected breaches may be more common than companies publicly report.
Experts say the technical sophistication of these attacks is increasing. Beyond simple facial spoofing, modern bypass systems may combine compromised devices, deepfake video generation, and injected code that manipulates app behavior. Cybersecurity firms report a sharp rise in such attacks over the past year, with some estimating that virtual-camera-based fraud attempts have increased many times over compared with just a few years ago.
Researchers and former hackers working in anti-fraud efforts describe how stolen funds are routed through networks of controlled accounts, often referred to as “water houses,” before being converted into stablecoins such as Tether. Transactions can occur in seconds, coordinated through tightly managed laundering pipelines that exploit weaknesses in verification systems and cross-border financial regulation.
While companies emphasize improved detection systems, critics argue enforcement is lagging behind innovation. Some analysts question whether compliance frameworks can keep pace with synthetic identity attacks. Others caution that some advertised bypass services may themselves be scams, making success rates difficult to verify.
Regulators are beginning to respond. Countries across Asia have tightened banking rules, and US authorities have issued warnings about deepfake identity fraud. Yet experts in the MIT Technology Review investigation say enforcement alone will not eliminate the problem, warning that verification systems remain in a cycle of adaptation and evasion.
As one researcher noted, the ecosystem has become self-sustaining: tighter security drives more advanced bypass tools, which in turn prompt further upgrades. Despite takedowns, the marketplace persists across encrypted platforms. The investigation concludes that the struggle between banks and scammers is far from resolved, and digital identity systems remain under sustained pressure.
