---
title: "How Fake IDs Are Made"
description: "Identity document forgery is a forensic subject before it is a criminal one. Every method a counterfeiter reaches for leaves a signature, and document examiners,…"
url: "https://unidata.pro/blog/how-fake-ids-are-made/"
date_modified: "2026-11-05T16:03:59+03:00"
language: "en-US"
---
![How Fake IDs Are Made](https://unidata.pro/wp-content/uploads/2026/11/how-fake-ids-are-made.webp)Identity document forgery is a forensic subject before it is a criminal one. Every method a counterfeiter reaches for leaves a signature, and document examiners, border officers and verification engineers spend their careers learning to read those signatures.

This article takes that view. It describes what forgery attempts consist of, what each one fails to reproduce, and how the people and systems on the other side catch them. Nothing here is a procedure: the useful knowledge in this field is on the detection side.

![](https://unidata.pro/wp-content/uploads/2026/09/liza-ai-testing.webp)

**About the author:** ******Elizabeth Karnaukhova******

Datamarket Project Manager. Leads synthetic passport and ID document generation projects

## Introduction to fake IDs

A fake ID is not one thing. Counterfeit or altered documents, documents correctly issued to the wrong person, and documents that exist only as an image all arrive at the same check, and each defeats a different part of it.

The scale is easier to state than the definitions, and the figures appear later in this article. Identity document forgery sits upstream of most recorded identity fraud: a forged or misappropriated document is what turns stolen personal data into an account, a loan or a tenancy.

![](https://unidata.pro/wp-content/uploads/2026/11/turkey-passport-cover-scaled-1-edited-1024x659.webp)*Fake ID example: a synthetic Turkish passport*Forgery is also a legal category, not only a technical one. That matters for the sections below, because the same physical artifact can be a minor licensing offence or a serious federal charge depending on which document it imitates and what it was used for.

### Legal implications of fake IDs

Penalties for identity document forgery vary sharply by jurisdiction and by document type, and anyone facing a specific question should take legal advice rather than an article's word for it. The broad shape is consistent across most legal systems, and worth knowing before the technical sections.

Three separate offences usually exist where a layman sees one.

1. Producing a false document is one offence.
2. Possessing it is a second, often with a lower threshold of proof.
3. Using it to obtain something, whether that is alcohol, a bank account or employment, is a third and typically the most serious, because it converts forgery into fraud.

Document type drives severity more than technique does. Imitating a national passport or an identity card generally sits in a different bracket from imitating a membership card, because travel documents are issued under international obligations and their integrity is treated as a matter of border security.

For businesses, the exposure runs the other way. Liability for accepting a false document usually attaches to the checking process rather than the deception: many regimes offer a defense where an organization can show it took reasonable steps and kept records. That is the practical reason a documented, consistently applied procedure is worth more than an expensive scanner used inconsistently.

Regulators have made the enforcement expectation explicit for financial institutions, publishing red-flag indicators for identity documents produced with generative AI and asking firms to reference them in suspicious activity reporting. Those indicators are set out in the AI section below.

## What are scannable fake IDs?

A scannable counterfeit is one that produces a plausible response when a reader interrogates its machine-readable parts, rather than only looking convincing to the eye.

Modern identity documents carry several machine-readable layers, and they differ enormously in how hard they are to imitate. A PDF417 barcode on a driving license encodes the holder's details as data. A magnetic stripe does the same on older cards. A machine-readable zone on a passport encodes the key fields as two lines of characters with check digits computed over them, specified in ICAO Doc 9303[4](https://unidata.pro/blog/how-fake-ids-are-made/#ref-4). An electronic passport adds a chip whose contents are digitally signed by the issuing authority.

The security difference between those layers is the whole subject. A barcode and a magnetic stripe are storage: they hold whatever was written to them, and nothing in the format proves who wrote it. A signed chip is an attestation: Passive Authentication verifies the signature against a public key infrastructure, which establishes that the data came from the issuer and has not been altered since[4](https://unidata.pro/blog/how-fake-ids-are-made/#ref-4).

That is why "scannable" describes a low bar rather than a high one. A counterfeit becomes scannable when its encoded data parses and agrees with itself. It does not thereby become authentic, and a reader that reports only "valid" has not told the operator which of those two things it checked.

The physical card matters here as well. Identity documents are built on controlled substrates with laminates, optically variable features and laser personalisation, and the encoded layers sit inside that construction rather than on top of it. A counterfeit has to satisfy the reader and the hand at once.

## Common methods of fake ID production

Document examiners classify forgeries by what was altered rather than by how skilfully it was done, because the class determines which check will catch it.

![Common methods of fake ID production](https://unidata.pro/wp-content/uploads/2026/11/forgery-methods.webp)The sections below follow that classification. Each describes what the method attempts, and then the part that matters operationally: the specific traces it leaves and the check that finds them. This is the forensic literature's own framing, and it is the reason document examination is teachable at all. None of these sections is a procedure, and the omissions are deliberate.

### Photo editing & manipulation

Photograph manipulation is the oldest digital method and still the most common, because the photograph is the one field that has to match a human being rather than a record.

Two variants exist.

- **In the first**, a genuine document is photographed or scanned and the portrait is replaced before the image is reused, which only works where the document is presented as an image rather than an object.
- **In the second**, the portrait on a physical card is physically substituted, which requires defeating the laminate and whatever security features cross the photograph boundary.

Both leave characteristic evidence. Image editing resamples pixels, and resampling leaves interpolation artifacts, inconsistent noise floors between the pasted region and its surroundings, and compression histories that do not match across the frame. Lighting direction and color temperature rarely agree between a portrait taken in one setting and a document photographed in another. On physical substitutions, the tell is usually mechanical: a laminate that has been lifted and reseated does not bond identically, security features that run across the photo edge break alignment, and the portrait sits at a different depth in the card.

Manipulation detection is where the field now overlaps with deepfake research, and the two share a weakness. Detectors are trained on the manipulations they have seen, and a technique absent from the training corpus is not recognized as anything.

### Scanning & reprinting

Reproducing a document by scanning and reprinting it is the method most people imagine, and the one that modern documents are specifically engineered to defeat.

The engineering works because the card is not an image. A scan captures reflected light at one angle under one illuminant, which is exactly the information that optically variable devices are designed not to carry. Holographic overlays, color-shifting inks and lenticular images change with viewing angle by design, so they flatten in a scan and reprint as a fixed pattern. Microprinting sits below the resolution of consumer scanning and printing, and reproduces as a gray line. Ultraviolet-reactive elements are invisible to ordinary scanning and absent from the reproduction entirely.

The substrate defeats reproduction independently of the printing. Identity cards use controlled polymer stock with specific thickness, stiffness, edge finish and optical properties, and personalisation is often laser-engraved into the core rather than printed onto a surface. A reprint on commercially available card stock differs in weight and flex, and the printed personalisation sits on the surface where the genuine version sits inside.

For a checker, this class is the most reliably caught, and the checks that catch it are the cheap ones: feel the card, tilt it, and put it under ultraviolet light.

### Templates and digital design

A template forgery reconstructs the document's layout rather than copying a specific card, which removes the scanning losses above and introduces a different failure: fidelity to a design the forger has not seen at high resolution.

Identity document designs are specified to a degree that rewards close comparison. Typeface, character spacing, field positions, the exact geometry of a state seal and the pitch of a guilloche pattern are all fixed by the issuing authority, and all of them drift in reconstruction. Examiners look for fonts that are close but not the issuing authority's, field baselines that sit a fraction of a millimeter off, and background security printing whose line frequency does not match.

The strongest signal in this class is internal inconsistency between design versions. Issuing authorities revise documents on a published schedule, and a template built from one version carries features that never coexisted with the date of issue printed on it. A license bearing a 2024 issue date in a pre-2019 layout is not a subtle forgery, but it passes anyone who has not been trained on the current design.

This is why current-design familiarity beats general vigilance. The checker who has handled this month's version of the three documents they actually see will outperform a checker who has read about security features in general.

### Materials and printing techniques

This section is where the outline's subject and useful publication part company, and it is worth saying why rather than writing around it.

A material and printing specification is not analytic content. Naming substrates, printer classes and laminate types in the order a forger would need them is a procurement list, and it provides no defensive value that the detection framing does not already provide better. The practical knowledge a verifier needs from this topic is the inverse, and it is already stated above: what genuine card construction does that reproduction cannot, and how that shows up in the hand and under a lamp.

What is worth adding is the economic point that material choice creates. Substrate, laminate and personalisation are where counterfeiting costs concentrate, and they scale badly. Reproducing a design is a fixed cost paid once. Reproducing a card's physical construction is a per-unit cost with specialized equipment behind it, which is why cheap counterfeits cluster at the visual layer and why tactile and optical checks catch a disproportionate share of what circulates.

For a verifier, the operational reading is that the most expensive thing to fake is the thing your hands are already touching. That asymmetry is the reason a five-second physical check remains competitive with equipment that costs thousands.

### Barcode replication and encoding

The machine-readable layer is also where the outline asks for encoding methodology, and the same limit applies. What follows is the verification view, which is the one that is useful and the one that is publishable.

Two facts about encoded data do most of the work. The first is that barcodes and magnetic stripes carry no cryptographic signature, so reading them proves that the encoding is well-formed and nothing more. The second is that the encoded data and the printed data are two separate representations of the same record, which have to be produced consistently to agree.

That second point is the single most productive check available on a non-chip document, and it is underused. Comparing the encoded date of birth, name and document number against the printed fields catches every forgery where the two were produced by different processes or at different times, which includes most alterations of a genuine card: the printed field is changed and the encoded one is not, or the reverse.

Machine-readable zones add a further layer, because ICAO Doc 9303 specifies check digits computed over the data fields[4](https://unidata.pro/blog/how-fake-ids-are-made/#ref-4). A zone that fails its own check digits is internally inconsistent before any comparison with the printed page.

Chip verification is categorically stronger than any of this and remains the most underused check in ordinary commercial settings. Where a document carries a signed chip, reading it answers the question the barcode cannot: whether the issuing authority produced this data.

### AI-generated and synthetic identity documents

Generative models changed the economics of the image-based attack, and they changed nothing about the physical one.

FinCEN, the US Treasury's financial-crime unit, reported an increase in suspicious activity filings describing generative AI used to alter or create the images on identification documents, including driving licenses and passport cards, to get past customer identification and verification controls[3](https://unidata.pro/blog/how-fake-ids-are-made/#ref-3). A related pattern combines a generated face with a mixture of real and fabricated personal data to build a synthetic identity that has no single real person behind it.

The important boundary is that this class exists only where the document is submitted as an image. There is no physical artifact, which means every tactile and optical check is unavailable by construction, and the entire defensive burden moves to image forensics, liveness checking and cross-referencing against the issuer.

Detection of this class relies as much on signals outside the image as inside it. FinCEN's published indicators include a reverse image search matching a known gallery of generated faces, inconsistencies between multiple documents from the same person, geographic or device data at odds with the stated identity, use of a third-party webcam plugin during a live check, and a refusal of multifactor authentication[3](https://unidata.pro/blog/how-fake-ids-are-made/#ref-3).

The constraint underneath all of it is data. A document classifier only recognizes the forgery types present in its training corpus, and the documents it most needs to learn are the ones nobody may lawfully assemble in bulk.

We found the edges of that trade-off while building a [generation pipeline for synthetic identity documents](https://unidata.pro/datasets/synthetic-passports/), covering passports, ID cards, visas and licenses for more than a hundred countries.

Our first generation looked artificial and failed to reproduce how genuine documents vary, and models trained on it generalized poorly and produced frequent false positives in verification. What [synthetic data](https://unidata.pro/blog/synthetic-data/) buys is control available no other way: you can dictate the country, the wear, and how badly the document was scanned. What it will not buy is reproducibility, and when a task depends on one physical object behaving identically twice, only real collection answers it.

## How verification systems work

A verification stack does three separable jobs, and most deployments buy one of them and assume the other two came along.

The identity proofing guidelines from NIST, the US standards body, split the work into steps that fail independently[5](https://unidata.pro/blog/how-fake-ids-are-made/#ref-5). You collect evidence, validate that the evidence is genuine and accurate, then verify that it belongs to the person presenting it. A forged document defeats the second step. A genuine document in the wrong hands defeats the third. A process built to catch one of these will let the other through at full rate, and the pass statistics will look healthy either way.

![How verification systems work](https://unidata.pro/wp-content/uploads/2026/11/three-proofing-steps.webp)Biometric comparison is what closes the third step, and it introduces its own failure modes, covered below.

### Physical security features

Genuine documents are built in layers that are individually reproducible and jointly expensive: a controlled substrate, optically variable ink or foil, microprinting below the resolution of consumer printers, ultraviolet-reactive elements, laser engraving, and tactile features you can feel with a fingernail.

The design intent is that no single piece of equipment reproduces all of them at once. That is a deliberate economic strategy rather than a technical one. Each layer individually can be approximated; the combination requires equipment from different industries, and the cost of assembling all of it exceeds what most counterfeit operations can recover.

Microprinting deserves particular attention because it is cheap to check and expensive to defeat. Text printed below roughly 0.25 mm resolves cleanly under a ten-times loupe on a genuine document and degrades into a gray line on anything reproduced by consumer equipment. The check takes seconds and needs a magnifier that costs almost nothing.

The practical version of all this for a business is narrower than the literature suggests. You do not need every feature of every jurisdiction. You need two or three features of the documents you actually see, checked in the same order every time, because a check applied inconsistently produces a pass rate rather than a defense.

### Electronic and digital verification

Electronic passports carry a chip whose contents are digitally signed by the issuing authority, and Passive Authentication verifies that signature against a public key infrastructure[4](https://unidata.pro/blog/how-fake-ids-are-made/#ref-4). That is a claim about provenance rather than appearance, and it is the strongest routine check available at a counter.

Most other documents offer nothing equivalent. Reading a barcode confirms encoding and nothing else, and treating a successful barcode read as authentication is the most common structural error in ID checking.

![Two read paths: signed chip and unsigned barcode](https://unidata.pro/wp-content/uploads/2026/11/two-read-paths.webp)Database verification sits alongside both. Where an issuing authority exposes a validation interface, querying it answers a question neither the card nor the chip can: whether this document is still valid, or has been reported lost, stolen or cancelled.

Regulation is moving toward closing the attestation gap. Regulation (EU) 2024/1183 established the European Digital Identity framework and entered into force on 20 May 2024[6](https://unidata.pro/blog/how-fake-ids-are-made/#ref-6). The European Commission has said Member States must provide EU Digital Identity Wallets to citizens by the end of 2026[7](https://unidata.pro/blog/how-fake-ids-are-made/#ref-7). The direction is cryptographic attestation replacing visual judgement, which changes what staff need to be trained on without removing the need to train them.

### AI-based fraud detection

Document classifiers compare a submitted image against known templates, measure font geometry and field spacing, and look for the resampling and compression artifacts that editing leaves behind. Face comparison systems match the portrait against a live capture. Liveness detection decides whether that capture came from a person.

All three are bounded by their training data rather than their architecture, and the boundedness is not evenly distributed. A detector trained mostly on attacks learns attacks and learns comparatively little about an ordinary face, so anything slightly outside its experience reads as an anomaly. It is a pattern [the checks we run on client liveness models](https://unidata.pro/ai-model-testing-services/) keep turning up: someone puts on glasses, or the room lighting is a little off, and a legitimate customer is told they are fake.

Independent measurement is the only way to see this. When the US Department of Homeland Security ran commercial remote identity systems through testing across document validation, selfie matching and presentation attack detection, the passive detection track produced attack classification error rates ranging from 0% to 100% across the fifteen systems evaluated[8](https://unidata.pro/blog/how-fake-ids-are-made/#ref-8).

![Attack classification error rate across fifteen tested systems](https://unidata.pro/wp-content/uploads/2026/11/attack-classification-error-rate.webp)

## How to spot fake IDs

The largest available improvement in most organizations costs nothing: check the same things in the same order on every document, including the ones that look fine.

Consistency beats sophistication here for a structural reason. A counterfeit only has to survive the check it actually meets, and a check that varies with how busy the counter is, or how plausible the person seems, is a check the document can get lucky with. The sections below give the sequence, the tools and the training that make it stick.

### Visual inspection techniques

Work through the document in a fixed sequence rather than scanning it for a general impression. Feel it, tilt it, light it, read it, then compare it to the person.

| **Step** | **What you are checking** | **What a failure looks like** |
|---|---|---|
| Feel | Substrate stiffness, edge finish, lamination | Soft or peeling edges, a seam, thickness that differs from a known-good card |
| Tilt | Optically variable ink, holographic overlay | An image that stays flat, shifts in the wrong direction, or sits on top of the surface |
| Light | UV-reactive print, microprinting under magnification | Blank under UV, or fine print that blurs into a gray line at magnification |
| Read | Printed fields against the machine-readable zone or barcode contents | Any disagreement between the two, particularly date of birth |
| Compare | Photograph against the bearer | Ear shape, hairline, and facial proportion rather than hairstyle or weight |

Two of those steps carry most of the detection value and get the least attention. The read step catches alterations that survive every visual check, because the encoded data was not altered with the printed data. The compare step is where untrained checkers anchor on hair and expression, which change; the useful features are the ones that do not.

Behavioral signals belong in the sequence too, without becoming the basis of a decision. Reluctance to hand the document over, a second document that disagrees with the first, and a stated age that does not match the printed one are all reasons to look harder rather than conclusions in themselves.

### Using verification tools and technology

A UV lamp and a ten-times loupe cost very little and address the two feature classes hardest to reproduce at home. A document scanner reads and cross-checks the encoded fields faster and more consistently than a person. A chip reader is the only one of the four that establishes who issued the document.

The recurring trap is interpreting output more generously than it deserves. A scanner reporting "valid" is reporting that it parsed the encoded data and found it self-consistent. Ask any vendor, in writing, which of these three their green result means: the encoding is well-formed, the encoding matches the printed fields, or the issuer signed it. The answers differ, and so does what the tool is worth.

Tool choice should follow the documents you actually see. An organization checking passports gains more from one chip reader than from any amount of image analysis, because chip reading answers the provenance question outright. An organization checking domestic driving licenses has no chip to read and gains more from encoded-versus-printed comparison and good lighting.

### Training staff for ID verification

Staff who have handled known fakes detect better than staff who have read a poster about them, so the training that changes outcomes involves physical specimens and time, not slides. Document designs also change on the issuer's schedule rather than yours, which makes this a recurring exercise instead of an induction item.

Law enforcement and border training is built around the same principle and is worth borrowing from: examiners are trained on genuine documents first and at length, because recognizing a counterfeit is a matter of noticing a departure from a familiar object rather than memorising a list of defects.

The part most often left out is the escalation path. A staff member who is unsure and whose only options are to accept the document or to accuse a customer will accept it, every time, and no amount of feature training changes that arithmetic. Give them a third option that costs nothing socially: a second checker, a manager, or a "let me just run this through the reader" that is standard for everyone.

## The evolution of fake IDs and countermeasures

Document security has run as an exchange for a century, and the exchange has a consistent shape: each countermeasure moves the attack to a layer the countermeasure does not cover.

Printed security features arrived first, and photographic reproduction answered them. Optically variable devices answered reproduction, and template reconstruction answered those by rebuilding the design rather than copying the card. Machine-readable encoding answered reconstruction, and encoding the same data consistently answered that. Cryptographic signing answers encoding, and it has no general answer yet, which is why chip verification remains the strongest check available.

The pattern worth extracting is that each generation of countermeasure moved the contest further from the physical object and closer to the issuing authority's records.

![Each countermeasure and the attack that answered it](https://unidata.pro/wp-content/uploads/2026/11/countermeasure-attack.webp)The endpoint of that trajectory is attestation, where the document stops being evidence in itself and becomes a pointer to a record that can be verified cryptographically.

### Current trends in ID fraud

Three developments define the current period, and only one of them concerns physical documents.

The first is the shift of attack volume into remote channels, where no physical artifact exists and the entire physical defense layer is unavailable. The second is generative AI, which reduced the cost and skill needed to produce convincing document images and synthetic faces[3](https://unidata.pro/blog/how-fake-ids-are-made/#ref-3). The third is the injection attack, which skips the camera entirely: a virtual camera driver or browser plugin presents prepared video to the application as though it were a live feed, so nothing is ever held up to a lens.

That third one matters disproportionately because of a scope boundary. ISO/IEC 30107-3 standardizes how to test presentation attack detection and defines the error rates vendors quote[9](https://unidata.pro/blog/how-fake-ids-are-made/#ref-9), and its scope covers attacks that take place at the capture device during presentation. An injection attack is out of scope by construction, which means a vendor's presentation-attack certification says nothing about it.

![Two attack entry points on the remote capture pipeline](https://unidata.pro/wp-content/uploads/2026/11/attacks-entry-points.webp)Certification has started to catch up unevenly. The FIDO Alliance's Face Verification Certification tests injection attacks as a threat category separate from facial liveness[10](https://unidata.pro/blog/how-fake-ids-are-made/#ref-10). On the ISO side there is no published standard: work on biometric deepfake attack detection was registered as ISO/IEC AWI 26655 in May 2026 and sits at the preparatory stage[11](https://unidata.pro/blog/how-fake-ids-are-made/#ref-11). You cannot currently ask a vendor for an ISO certification against injection attacks, because one does not exist.

Dark web marketplaces continue to distribute both physical counterfeits and document images, which mainly affects volume and accessibility rather than the technical picture above.

### Future of document security

The direction is already visible in regulation and in standards work, and it points away from the document as an object.

Digital identity wallets are the clearest signal. Regulation (EU) 2024/1183 established the European framework[6](https://unidata.pro/blog/how-fake-ids-are-made/#ref-6). The European Commission has set the end of 2026 as the deadline for Member States to provide wallets[7](https://unidata.pro/blog/how-fake-ids-are-made/#ref-7). In that model the holder presents a cryptographically signed attestation rather than a card, and the verifier checks a signature rather than a substrate. Selective disclosure becomes possible in the same move: proving an age threshold without disclosing a date of birth removes the reason to copy the document at all.

Biometric verification will carry more of the load as attestation carries the document half, which raises the stakes on the failure modes above. Morphed portraits are the sharpest example. A morph is a single photograph blended from two faces, submitted with a genuine application so that the resulting genuine document matches both people. NIST's evaluation of automated morph detection found miss rates above 0.88 at a false detection rate of 0.01[12](https://unidata.pro/blog/how-fake-ids-are-made/#ref-12). At the cost of wrongly flagging one legitimate photo in every hundred, more than 88% of actual morphs went undetected, across every algorithm and every dataset tested. That report is from 2020 and NIST has since folded morph detection into its continuing face technology evaluations[13](https://unidata.pro/blog/how-fake-ids-are-made/#ref-13), so current numbers will differ, but the structural point stands: the document is genuine, so a process that only authenticates documents cannot see it.

## Implications and societal impact

The cost of identity document forgery is usually discussed as underage purchasing, which is the smallest part of it.

Identity fraud is the larger consequence, and the volumes above give its scale: 1.1 million identity theft reports to the FTC in 2024[1](https://unidata.pro/blog/how-fake-ids-are-made/#ref-1), over 242,000 identity fraud cases to the UK National Fraud Database in 2025[2](https://unidata.pro/blog/how-fake-ids-are-made/#ref-2). A forged or misappropriated document is what converts stolen data into accounts, credit and tenancies, and the person whose identity was used carries the remediation.

Underneath the individual harm is a systemic one. Identity verification is infrastructure that everything else assumes: hiring, banking, healthcare records, property, benefits. Each successful forgery is a small withdrawal from the assumption that a presented document means what it says, and the replacement for that assumption is friction applied to everybody.

### Risks for businesses and organizations

Organizations carry three distinct exposures, and they are usually budgeted as one.

Regulatory exposure comes first for licensed activities: age-restricted sales, financial onboarding and right-to-work checks all carry obligations whose breach is penalised independently of whether fraud followed. Financial exposure follows from the fraud itself, through chargebacks, unrecoverable credit and the cost of investigation. Reputational exposure lands last and lasts longest, particularly where the failure becomes a matter of public record.

The exposure nobody budgets for is the opposite error.

![Risks for businesses and organizations](https://unidata.pro/wp-content/uploads/2026/11/error-types.webp)Every false rejection is a customer who does not complete onboarding, a queue at a door, and a staff member handling a complaint. Unlike the accepted forgery, it happens every day rather than occasionally, and it never appears in a fraud report because nothing fraudulent occurred.

Both errors are set by the same threshold, which is why moving it without measuring is expensive in one direction or the other.

### Protection strategies for individuals and organizations

For individuals, the objective is to reduce the material available for forgery. Identity documents are the highest-value items in most people's possession from a fraud perspective, and images of them are nearly as valuable as the originals. Sending photographs of documents through messaging apps and email leaves copies in places nobody controls. Checking credit files periodically catches misuse that is otherwise invisible until an application is refused.

For organizations, the checklist is short and the order matters.

- Write the checking procedure down, including the escalation path, and apply it to every document rather than to suspicious ones
- Train on physical specimens and current designs, and repeat it when designs change
- Read the chip where one exists, and compare encoded against printed fields where one does not
- Ask vendors what their pass result actually verifies, and get the answer in writing
- Measure the false rejection rate alongside the detection rate, and review both by segment

The last point repays the most effort. An aggregate accuracy number is an average over whatever population the test set happened to contain, and certification schemes tend to grade the weakest group rather than the mean. A model can sit comfortably above threshold overall and still fail on the segment being measured, which is the same [subgroup blind spot](https://unidata.pro/blog/understanding-bias-in-ml/) that shows up across computer vision.

One client's verification model read 91% overall and looked certification-ready on that basis, until the number was split by ethnicity. To close the gap we ran [actors across a genuine ethnic range through photo](https://unidata.pro/cases/ethnic-coverage-expansion-for-ibeta-level-1-certification/), mask and replay attacks, fifty of them, because the shortfall had to be measured before anyone could size the fix. Coverage is the one thing you cannot buy for a gap you have not measured.

The same logic applies to the attack side. A liveness system meets attacks its builders never showed it, and a figure produced under controlled conditions describes the conditions rather than the system. That is why we [collect print and replay attacks](https://unidata.pro/datasets/dataset-type/ibeta/) continuously, from participants actively trying to defeat a live system, and why [certification against presentation attacks](https://unidata.pro/blog/ibeta-level-3-new-standards/) is worth asking about specifically rather than accepting as covered.

## Conclusion

Identity document forgery is best understood from the detection side, and not only for ethical reasons. The classification that matters is what a forgery failed to reproduce, because that determines which check finds it: reproduction fails on substrate and optics, template reconstruction fails on design fidelity, alteration fails on the disagreement between encoded and printed data, and image-based forgery fails only where a live check on the person exists.

Three habits cover most of that ground. Physical inspection in a fixed order, a chip read wherever the document supports one, and a vendor whose error rates you have seen broken down by segment rather than averaged. None of them is expensive, and the first is free.

What sits underneath is measurement, and measurement needs material to measure against. Detection systems are bounded by what they were trained and tested on, which is why coverage gaps stay invisible until someone deliberately looks for them, and why closing one takes data that covers it. If you need attack data to test a verification model against, from print, replay and mask attacks to identity documents across many jurisdictions, [start here](https://unidata.pro/datasets/dataset-type/biometrics/).

## Additional Modules

### FAQ Section

**Questions and Answers:**

- **Question:** What makes an ID scannable? — **Answer:** An identity document is scannable when it carries machine-readable elements: a PDF417 barcode, a magnetic stripe, a machine-readable zone of characters with check digits, or a contactless chip. A reader extracts the encoded data and checks it parses. Only the chip carries a cryptographic signature from the issuing authority, which is what separates proof of issuance from proof of encoding.
- **Question:** How do materials give a counterfeit away? — **Answer:** Identity cards use controlled polymer stock with specific thickness, stiffness and edge finish, often with laser engraving cut into the core rather than printed on the surface. Reproductions differ in weight and flex, have surface-printed personalisation, and show laminate edges that can be felt. This is why a five-second physical handling check catches a disproportionate share of what circulates.
- **Question:** How has fake ID technology evolved over the years? — **Answer:** As an exchange. Printed security features were answered by photographic reproduction, optically variable devices by template reconstruction, and machine-readable encoding by consistent re-encoding. Each countermeasure moved the contest further from the physical object and closer to the issuing authority’s records. Cryptographic signing is the current position and has no general answer, which is why chip verification remains the strongest available check.
- **Question:** What security features do modern IDs have to prevent counterfeiting? — **Answer:** Layered ones, designed so that no single piece of equipment reproduces all of them. Typical layers include a controlled substrate, optically variable ink or holographic overlays, microprinting below consumer printer resolution, ultraviolet-reactive elements, tactile embossing and laser-engraved personalisation. Travel documents add a machine-readable zone with check digits and, increasingly, a digitally signed chip. Security comes from the combination.
- **Question:** How do authorities detect fake IDs? — **Answer:** Through a fixed sequence rather than a single test. Examiners handle the document, tilt it to check optically variable features, examine it under ultraviolet light and magnification, compare printed fields against encoded ones, and read the chip where one exists. Border and law enforcement examiners are trained on genuine documents at length first, because recognizing a counterfeit means noticing a departure from a familiar object.
- **Question:** What is the difference between amateur and professional fake IDs? — **Answer:** Where they fail. Amateur work fails at the visual layer and is caught by tilting the card or putting it under ultraviolet light. Professional work reproduces the visual layer convincingly and fails on the encoded data, the substrate construction, or fidelity to the current design version. The check that catches each is different, which is why a fixed sequence outperforms a single test.
- **Question:** Why do barcode and printed data disagree on a forgery? — **Answer:** Because they are two separate representations of the same record, produced by different processes. When a genuine card is altered, the printed field is changed and the encoded one is not, or the reverse. When a counterfeit is produced from a template, the two are generated independently and drift. Comparing them is the single most productive check available on a document without a chip.
- **Question:** What does a magnetic stripe read actually prove? — **Answer:** That the stripe holds well-formed data. Magnetic stripes and barcodes are storage rather than attestation: they carry whatever was written to them, and nothing in either format identifies who wrote it. A successful read tells you the encoding parsed, not that an authority issued the document. Only a cryptographically signed chip answers the issuance question.
- **Question:** How is AI being used to create more sophisticated fake IDs? — **Answer:** Generative models lowered the cost and skill needed to produce convincing document images and synthetic faces, and to combine a generated face with a mixture of real and fabricated personal data. FinCEN has reported increased suspicious activity filings describing exactly this. The class only exists where documents are submitted as images, because no physical artifact is produced and no physical check applies.
- **Question:** What are the legal penalties for making or possessing fake IDs? — **Answer:** They vary sharply by jurisdiction and document type, and a specific question needs legal advice. Broadly, most systems separate three offences: producing a false document, possessing one, and using it to obtain something. The third is usually most serious because it converts forgery into fraud. Imitating a passport or national identity card generally sits in a more serious bracket than other documents.
- **Question:** What are scannable fake IDs? — **Answer:** Counterfeits that produce a plausible response when a reader interrogates their machine-readable parts, rather than only looking convincing. Becoming scannable is a lower bar than it sounds: the encoded data has to parse and agree with itself. It does not make the document authentic, and a reader reporting only “valid” has not told the operator which of those two things it verified.
- **Question:** How do fake ID scanners work? — **Answer:** Most read the barcode or magnetic stripe, parse the encoded fields and check them for internal consistency, including check digits. Better units compare those fields against the printed text and read passport chips. Which of these a particular scanner does matters more than the brand, because a device that only parses encoding cannot tell you whether an issuing authority ever produced the document.
- **Question:** Do fake IDs work? — **Answer:** Against inconsistent checking, frequently. Against a fixed sequence that includes handling the card, tilting it, checking it under ultraviolet light and comparing encoded data against printed fields, much less often. Against a chip read, essentially not at all, because that check verifies a signature from the issuing authority rather than the document’s appearance.
- **Question:** How to check for fake IDs? — **Answer:** Use the same sequence every time: feel the substrate and edges, tilt for optically variable features, check under ultraviolet light and magnification, compare the printed fields against the barcode or machine-readable zone, then compare the photograph to the bearer using stable features such as ear shape and facial proportion. Read the chip where the document has one.
- **Question:** How does scanning an ID work? — **Answer:** The reader locates the machine-readable element, decodes it, and parses the result into fields. For a machine-readable zone it also recomputes check digits over the data. For a chip it performs a cryptographic exchange with the issuing authority’s public key infrastructure. Some systems then compare the decoded fields against the printed text using optical character recognition.
- **Question:** Are fake IDs illegal? — **Answer:** Yes, in effectively every jurisdiction, though the specific offence and severity vary. Most systems treat production, possession and use as separate offences, with use being the most serious. Documents issued under international obligations, particularly passports, are usually treated more seriously than domestic or private documents.
- **Question:** Is a business liable for selling to someone using a fake ID? — **Answer:** It depends heavily on jurisdiction and sector, and this is a question for a lawyer rather than an article. Broadly, many regimes offer a defense where a business can show it took reasonable steps and kept records, which makes a documented, consistently applied checking procedure valuable for reasons beyond detection. Financial services and age-restricted sales typically carry the strictest obligations.
- **Question:** Can you tell if an ID is fake using a flashlight? — **Answer:** Partly. An ultraviolet lamp reveals fluorescent print and patterns that ordinary printers cannot reproduce, and a genuine document that appears blank under UV is a strong signal. White light held at an angle also exposes flat or wrongly oriented holograms. Neither catches a genuine document presented by the wrong person, and neither applies to remote verification, where no physical object exists.
- **Question:** What is an AI fake ID? — **Answer:** An identity document image produced or altered with generative models rather than printed and photographed. It may be an edited photograph on an otherwise genuine template, a fully generated document, or a generated face paired with a mixture of real and fabricated personal data. Because the artifact is a file rather than an object, it targets remote verification flows where physical inspection is impossible.
- **Question:** What are the dangers of AI-generated fake IDs? — **Answer:** They remove the cost barrier that limited volume, and they bypass the entire physical defense layer because no object exists. They also enable synthetic identities with no real person behind them, which are harder to detect than stolen identities because no victim reports anything. The defensive burden moves onto image forensics, liveness checking and cross-referencing against the issuer.
- **Question:** How do fake IDs erode trust in digital identity verification? — **Answer:** Each successful forgery is a withdrawal from the assumption that a presented document means what it says. The replacement for that assumption is friction applied to everybody: more checks, more documents requested, more rejections of legitimate people. The cost lands on users who did nothing wrong, and it is the reason attestation-based systems are being built.
- **Question:** How to spot an AI-produced fake ID? — **Answer:** Through signals outside the image as much as inside it. Recognized indicators include inconsistencies between multiple documents from the same person, a reverse image search matching a known gallery of generated faces, metadata that does not fit the claimed capture device, and geographic or device data at odds with the stated identity. Detection software helps, but reliability varies enormously between products.
- **Question:** What methods are used to detect fake IDs? — **Answer:** Four layers. Physical inspection covers substrate, optically variable features, microprinting and ultraviolet elements. Encoded-data comparison checks the barcode or machine-readable zone against the printed fields. Chip verification confirms the issuing authority’s signature. Biometric comparison confirms the document belongs to the person presenting it. Each catches a different class, and no single layer covers them all.
- **Question:** How do counterfeiters use photo editing and manipulation? — **Answer:** They alter or replace the portrait, which is the one field that must match a person rather than a record. What matters operationally is what this leaves behind: resampling artifacts, noise floors that differ between the pasted region and its surroundings, lighting direction and color temperature that do not agree, and on physical cards, a laminate that has been lifted and reseated and security features that break alignment across the photo edge.
- **Question:** How is identity theft used for creating fake ID cards? — **Answer:** Stolen personal data supplies the fields a forged document needs to survive cross-referencing. A more difficult variant combines real and fabricated data into a synthetic identity that corresponds to no single person, which is harder to detect precisely because no victim notices anything to report. This is why verification against issuer records outperforms verification against the document alone.
- **Question:** Why can't a scan and reprint reproduce a genuine card? — **Answer:** Because the card is not an image. A scan captures reflected light at one angle, which is exactly what optically variable devices are designed not to carry, so holograms and color-shifting inks flatten. Microprinting sits below consumer scanning resolution and ultraviolet elements are invisible to ordinary scanning. The substrate differs in weight, stiffness and edge finish, and laser engraving cut into the core cannot be surface-printed.
- **Question:** What is digital fake ID card technology? — **Answer:** Documents that exist only as files rather than objects, submitted to remote verification flows. They range from edited photographs of genuine cards to fully generated images. The category also covers attacks on the verification channel itself, such as injection attacks where prepared video is fed directly to the application through a virtual camera, bypassing the camera entirely.
- **Question:** What visual inspection techniques can identify fake IDs? — **Answer:** A fixed five-step sequence: feel the substrate and edges, tilt the card to check optically variable features, examine it under ultraviolet light and a loupe, read the printed fields against the encoded ones, and compare the photograph to the bearer. The read step and the compare step carry most of the detection value and receive the least attention in practice.

### references

**List of Links:**

- **Link:** [[1] Federal Trade Commission. "Consumer Sentinel Network Data Book 2024" — Federal Trade Commission — 2025](https://www.ftc.gov/reports/consumer-sentinel-network-data-book-2024) — **Active link:** Active link
- **Link:** [[2] Cifas. "Fraudscape 2026" — Cifas — 2026](https://www.cifas.org.uk/newsroom/fraudscape2026) — **Active link:** Active link
- **Link:** [[3] Financial Crimes Enforcement Network. "FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions" (FIN-2024-Alert004) — U.S. Department of the Treasury — 2024](https://www.fincen.gov/system/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf) — **Active link:** Active link
- **Link:** [[4] International Civil Aviation Organization. "Doc 9303, Machine Readable Travel Documents, Part 3: Specifications Common to all MRTDs" — ICAO, Eighth Edition — 2021](https://www.icao.int/publications/Documents/9303_p3_cons_en.pdf) — **Active link:** Active link
- **Link:** [[5] Temoshok, D., Abruzzi, C., Choong, Y.-Y., et al. "Digital Identity Guidelines: Identity Proofing and Enrollment" — NIST Special Publication 800-63A-4 — 2025](https://csrc.nist.gov/pubs/sp/800/63/a/4/final) — **Active link:** Active link
- **Link:** [[6] European Parliament and Council. "Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework" — Official Journal of the European Union — 2024](https://eur-lex.europa.eu/eli/reg/2024/1183/oj) — **Active link:** Active link
- **Link:** [[7] European Commission. "European Digital Identity (EUDI) Regulation" — European Commission, DG CONNECT — 2026](https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation) — **Active link:** Active link
- **Link:** [[8] Department of Homeland Security Science and Technology Directorate. "Remote Identity Validation Technology Demonstration (RIVTD) Results" — Maryland Test Facility — 2023](https://mdtf.org/rivtd/Results2023) — **Active link:** Active link
- **Link:** [[9] ISO/IEC. "Information technology — Biometric presentation attack detection — Part 3: Testing and reporting" — ISO/IEC 30107-3:2023, Edition 2 — 2023](https://www.iso.org/standard/79520.html) — **Active link:** Active link
- **Link:** [[10] FIDO Alliance. "Face Verification Certification Program" — FIDO Alliance — 2024](https://fidoalliance.org/certification/identity-verification/face-verification/) — **Active link:** Active link
- **Link:** [[11] ISO/IEC. "Information technology — Biometric deepfake attack detection — Testing and reporting" — ISO/IEC AWI 26655, stage 20.00 — 2026](https://www.iso.org/standard/94170.html) — **Active link:** Active link
- **Link:** [[12] Ngan, M., Grother, P., Hanaoka, K., Kuo, J. "Face Recognition Vendor Test (FRVT) Part 4: MORPH — Performance of Automated Face Morph Detection" — NIST Interagency Report 8292 — 2020](https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8292.pdf) — **Active link:** Active link
- **Link:** [[13] National Institute of Standards and Technology. "Face Technology Evaluations — FRTE/FATE" — NIST — 2025](https://www.nist.gov/programs-projects/face-technology-evaluations-frtefate) — **Active link:** Active link

[Full list of this site's AI-readable pages](https://unidata.pro/llms.txt)