Scammers are after people like you
Deepfakes have evolved into a practical tool that scammers use to target everyday Americans.
Coveron research reveals how easy — and cheap — deepfake fraud has become.
About the research
Deepfakes were once mostly used to impersonate celebrities. Now online criminals use these AI-generated videos, images, and documents to scam regular people. An investigation by Coveron, supported by NordLayer Intelligence, a threat exposure management platform, found that dark web forums are now selling deepfake services for building synthetic identities — fake profiles made from stolen data combined with AI-generated details. And everyone’s a target.
If your Social Security number (SSN) or date of birth was ever leaked online in a data breach, criminals can combine it with a deepfake photo and forged documents to create a new identity — part real, part fake. They can then use this synthetic identity to open bank accounts or take out loans, which can ruin your credit and leave you dealing with debt you never took on.
The deepfake industry is exploding — and you’re the target
7.6x
increase in deepfake-related discussions on the dark web in just two years
Under $100
what scammers need to build a fake identity using your stolen data
10,000+
dark web listings for ready-made identity packages over the past year
Dark web chatter on deepfakes is booming
In early 2024, an average of 40 discussions per month about deepfake technologies took place on dark web forums. By mid 2026, the average number of discussions went up to 307 — a 7.6x increase in just two years — with June seeing a peak of 549 posts. What was once a niche topic among hackers has turned into a booming criminal market.
The shift happened in mid-2025, when face-swapping software became widely available and easy to use. At the same time, deepfake-as-a-service offerings flooded the dark web. Scammers no longer need strong technical skills to create convincing fake calls or forge identity documents — all they need is access to the dark web and your data, exposed in data breaches.
How much does it cost to fake an identity?
Criminals don’t need to build fake identities from scratch. They can buy ready-made services on the dark web — everything from deepfake selfies with documents to full synthetic identity kits. For example, a Know Your Customer (KYC) photo bypass that uses your stolen information allows scammers to create accounts at banks or cryptocurrency exchanges. How much do you think these services cost?
Deepfake fraud services and prices
Prices from dark web forums and Telegram marketplaces, 2025–2026.
Individual services billed per use
-
KYC photo bypass
Instant Telegram bot delivery.
$10 – $50
-
Deepfake selfie with documents
Forum vendors, delivered in 24–48 hours.
$50 – $200
-
Custom voice clone
Three-second sample, multiple languages.
$50 – $300
-
Real-time face swap
Specialized vendors, live video call bypass.
$100 – $500
Complete packages bundled for end-to-end fraud
-
Synthetic identity, United States
Full personal details, face, and supporting documents. Opens bank accounts.
$200 – $1,000+
-
Digital ghost package
Identity aged 6-24 months. Verified accounts, matched device fingerprint.
$500 – $2,000+
Digital ghosts: Undetectable fake identities
Digital ghost packages are fully equipped synthetic identities designed to look and act like real people online. Scammers buy them to commit large-scale fraud, launder money, and evade law enforcement.
These packages come pre-loaded with stolen SSNs and dates of birth, deepfake selfies, forged documents, and accounts that have already passed verification on platforms like PayPal, Revolut, and cryptocurrency exchanges. Digital ghosts are created to pass every security check, and they’re constructed using your stolen data.
Synthetic identity fraud — a booming industry
We’ve analyzed over 362,000 dark web and Telegram posts from the beginning of 2024 to mid-2026 and found that synthetic identity fraud is no longer a niche threat — it’s an organized underground industry.
10,463
posts offered complete identity packages bundled with deepfake selfies and matching documents.
4,753
posts provided step-by-step tutorials on creating and aging fake identities over 6–24 months.
7,845
posts sold “raw KYC bypass kits” — SSNs, driver’s licenses, and deepfake selfies bundled together.
3,176
posts detailed fraud tactics for exploiting loans, taxes, crypto exchanges, and government benefits.
Synthetic Americans
A synthetic identity is part you, part fiction — a fake “person” built from your stolen data mixed with fabricated details. With millions of Americans’ SSNs and personal details already exposed in data breaches, no one knows how many synthetic Americans are on the internet right now. Here’s how they’re devised.
Building the fake person
Criminals create synthetic identities in different ways. One typical method is to start with a real SSN stolen in a data breach — often from a child, an elderly person, or a deceased individual whose credit isn’t monitored. They pair the SSN with a fake name, a made-up birthday, and an AI-generated photo. The result is a person who doesn’t exist but looks real on paper.
Making it look legitimate
Next, they build credit. The scammer uses the fake identity to apply for credit cards with low limits and utility accounts, makes on-time payments for months, and slowly gains trust with financial institutions. Credit bureaus start tracking this “person” as real. Over time, this identity qualifies for bigger loans and higher credit limits.
The cash-out
Once the identity has established enough trust and credit, the scammer strikes. They can max out every credit line, take out multiple loans, and disappear — leaving banks with unpaid debt and the real SSN owner with a damaged credit file.
The anatomy of a fake identity
Part real, part fake — see what criminals use to create a synthetic identity that passes as legitimate.
The fallout: What deepfake fraud costs you
If scammers use your information to create a synthetic identity, you could spend months or years proving you didn’t take out the loans, open the accounts, or commit the crimes associated with your name — all while your credit tanks and debt collectors keep calling.
Destroyed credit
Fraudulent accounts and unpaid loans tied to your SSN can tank your credit score. You may be denied a mortgage, a car loan, or even a job.
Debt that isn’t yours
Collections agencies start calling about loans you never applied for, credit cards you never opened, or bills you never ran up. Proving it wasn’t you takes months of paperwork, disputes, and legal filings.
Legal nightmares
If a scammer using a synthetic identity built with your SSN commits fraud or even a crime, you could be the one getting flagged. Victims have been questioned by police, audited by the IRS, and denied government benefits — all because a fake person used their real information.
How can you protect your digital identity?
Protecting your identity and personal information starts with knowing what to do.
Check if your personal information has been leaked on the dark web using a free dark web scanner. The sooner you know your data is exposed, the faster you can freeze accounts, change passwords, and limit the damage before criminals use it.
Methodology
This research was conducted jointly by Coveron and NordLayer Intelligence by NordStellar, a threat exposure management platform. Researchers gathered data from dark web forums and Telegram channels using NordLayer Intelligence by NordStellar's Enterprise Data API. They analyzed 22 targeted queries from Q1 2024 to Q2 2026 and captured over 362,000 posts related to identity fraud, deepfake services, and synthetic identity creation. Breach data analysis covers publicly disclosed incidents through the end of 2025. Additional sources for breach information include HaveIBeenPwned, HHS OCR, the 2024 US Census, Trend Micro, FBI IC3, and Statista.
NordLayer Intelligence by NordStellar, the threat exposure management platform, does not capture all data breaches because not all incidents are publicly disclosed or leaked.
Press materials
Download assets and infographics from this research.
For interview or press inquiries, contact us at [email protected]