CertiK has unveiled an underground ring of KYC actors for hire, used by rogue developers to scam Web3 communities.

Basic KYC verifications are regularly effective at annoying honest retail users, but unfortunately less so at stopping determined criminals from defrauding victims and laundering their stolen funds. Indeed, CertiK’s investigation confirms that criminals have developed several ways to bypass regular verifications, and the existence of professional “KYC actors” illustrates how easy it is to escape accountability. From our conversation with a “KYC actor”, to our deep-dive investigation into their underground world, let’s discover the dark side of the KYC industry, along with best practices for protecting communities and organizations.

A Conversation With a KYC Actor

Among the several tactics used by crypto developers who intend to scam communities and investors, the use of a KYC actor is certainly one of the most fascinating tactics detected and investigated by CertiK. In our context, a KYC actor is an individual specifically hired to KYC on behalf of rogue project owners looking to gain trust in the crypto community prior to an insider hack or an exit scam. In a particular case, after CertiK’s investigators detected and identified a KYC actor, the subject agreed to provide detailed information about the KYC actor process and industry.

According to this actor, it is surprisingly cheap and easy to hire someone to KYC for a fraudulent endeavor. He detailed how he had been posing for fake KYCs for over 3 years, and explained how simple it was for him to pass a regular KYC verification. In addition, he provided proof of transactions for his KYC gigs, as well as links to the specialized marketplaces where he finds his criminal clients. However, the reality of this undercover life is not nearly as glamorous as portrayed by Hollywood. Our interviewee showed us around his humble surroundings, explaining that most KYC actors are based in developing countries and are paid a small amount for each ‘role’, with his earnings amounting to just 20 to 30 USD per deal. This sad situation is unfortunately not surprising as we know that the modern scamming industry has no shame in organizing human trafficking and slavery for their benefit.

KYC Actor Dark Markets

Based on this insider information, our intelligence analysts were able to launch a deep dive investigation into the dark KYC marketplaces to better assess the situation and see what we could learn from it. We thoroughly scanned the activity of over 20 over-the-counter (OTC) underground markets, most of them hosted on Telegram, Discord, as well as some low-requirement phone-based apps, along with job ads placed on gig websites. Sellers and buyers meet on these OTC marketplaces based on their specific transaction requirements, negotiate their price, and usually use an escrow service for the payment. Rogue developers who prepare crypto scams also use these service to recruit KYC actors, but they represent a marginal activity percentage compared to the number of transactions for already-KYCed bank or exchange accounts, as well as direct crypto/fiat currency deals.

The cost of a KYC actor can be as low as 8 USD if the gig requirements are low - for example, bypassing a basic KYC process to open a bank or exchange account from a developing country. The price increases if the KYC actor has to face a more complex verification process, and jumps significantly if the buyer needs an actor who is a national resident of a country that is considered low-risk for money laundering, thus having a lower probability of being flagged or rejected, as well as access to a lot more services. On certain instances, we found some KYC actor roles, such as acting as the CEO of a crypto project, paid up to 500 USD a week. Our explorations show that the global prevalence of these OTC marketplaces is significant, with an above average concentration in South-East Asia and group sizes ranging from 4,000 to 300,000 members. We counted a staggering total of more than 500,000 members who were either buyers or sellers of these underground currency exchanges and fake KYC services.

The Threat of Fake KYC Badges

As observed during our interview and the subsequent investigation into the underground industry, KYC actors are not employed to protect privacy or financial freedom, but very clearly to steal funds from investors. The Web3 industry has understood that the team behind a project can be a major source of operational, reputational and legal risk, and in response, more than 40 websites have popped up offering crypto “KYC badges”, supposedly vetting project teams, with the latest numbers showing these websites have already issued over 2000 badges.

The sad reality is that the majority of these improvised verification services are worthless, because they are either too superficial to detect fraud or simply too amateur to detect insider threats, with the KYC teams missing the necessary background investigation methodology, training and experience. This can lead to very serious consequences, as fraudulent teams can easily bypass their verification process, leverage these unreliable KYC badges to mislead and scam additional investors, and escape accountability for their crimes.

How to Truly Verify a Project Team

Partnering with or investing in a Web3 start-up requires the highest level of due diligence, and the amounts of funds at stake in crypto projects are too high to rely on a simple ID-check and namecheck which can be easily faked today by determined criminals. The only way to truly verify the team behind a project is to conduct a proper, thorough background investigation on each key member and ensure this investigation is carried out by a team of professional, experienced criminal investigators and intelligence analysts.

CertiK has built such a team and process, and their investigative unit has been able to successfully detect human insider threats within project teams several weeks before they conducted insider hacks or exit scams. CertiK’s proprietary set of discrepancy and fraud signals allows for metric based, early threat detection, even with remote employees in developing countries. The scientific methodology used is especially effective in detecting KYC actors, as well as criminal operators hiding behind secondary team-members, in addition to developers attempting to conceal their involvement in previous scams and hacks.