MetaCity's Identity Verification System Has Been Approving Accounts Submitted With AI-Generated Face Photos for 14 Months — Approximately 190,000 Verified Accounts Are Estimated to Have No Real Human Behind Them

A security researcher has demonstrated that MetaCity's identity verification system — which grants accounts a Verified badge and elevated platform trust status — can be reliably passed using AI-generated facial photographs with no real human present. The researcher tested 50 AI-generated faces against the verification system; 47 passed. Analysis of verification approval patterns over the past 14 months suggests approximately 190,000 currently verified accounts were approved using synthetic face images. Verified accounts on MetaCity receive elevated permissions including access to governance voting, merchant storefronts, and priority content distribution. MetaCity has suspended new verification submissions while it reviews the system.

The 94% success rate the researcher achieved is not a marginal vulnerability — it describes a system that provides essentially no resistance to AI-generated identity fraud when the attacker uses consistent synthetic credentials. The verification process was designed around the assumption that generating a convincing fake ID photo and a matching fake selfie was beyond the practical capability of bad actors. That assumption was accurate when the system was designed. It has not been accurate for some time. The matching problem — generating a synthetic face and then generating a matching ID document using the same face — is a task that modern generative image tools handle reliably. MetaCity's verification system was not updated to account for this shift. The result is that a control which was designed to distinguish real humans from fake accounts has been providing verified status to whoever could generate a convincing synthetic face, which is most people with access to current generation AI tools.

The governance dimension is the most structurally significant consequence of 190,000 fraudulent verified accounts. MetaCity's governance system — district councils, platform policy votes, administrative roles — requires verified account status to participate. The verification requirement was designed to prevent Sybil attacks: the creation of large numbers of fake accounts to dominate governance outcomes. If 190,000 currently active verified accounts are synthetic identities, the Sybil protection that verification was supposed to provide has been absent for 14 months. Any governance vote, district council election, or policy decision that took place over the past 14 months could potentially have been influenced by verified accounts that were not real humans. MetaCity has not addressed whether any governance outcomes will be reviewed, or whether the votes cast by accounts that may be synthetic will be audited against close decision margins.

The Face Was Synthetic. The Verification Badge Was Real. 190,000 Times.

The merchant storefront and monetization access is the commercial fraud layer. Verified status is required to operate a merchant account in MetaCity's marketplace — the verification requirement exists to prevent scam storefronts and protect buyers. Verified accounts also receive priority content distribution and reduced moderation friction, which are meaningful competitive advantages in the creator economy. If a significant fraction of the 190,000 fraudulently verified accounts were used to operate storefronts or monetize content, the damages extend to buyers who transacted with them and to legitimate verified creators who competed for distribution against accounts whose verified status was obtained through synthetic identity fraud. MetaCity's suspension of new verification submissions pauses the ongoing harm. It does not address 14 months of decisions and transactions made under the assumption that verified status meant what it was supposed to mean.