Document fraud detection: how to tell if an ID is fake from a photo
You can’t touch or tilt an ID in a remote flow. Here’s what a photo can and can’t show, seven checks that help you spot a fake, and what to do when one looks off.
Document fraud detection is the work of deciding whether an identity document is genuine, unaltered and being used by the person it was issued to. When you only see an ID as photos in a remote onboarding flow, you can’t touch it, tilt it or put it under ultraviolet (UV) light, so you rely on what an image can show: the data, the layout, signs of editing and a live comparison with the person.
That limits how sure you can be. Below: the main types of document fraud, what a photo can and can’t tell you, practical ways to tell if an ID is fake when you can’t hold it, and what to do when something looks wrong.
Types of document fraud to watch for
The 2025 driver’s license and ID card design standard from the American Association of Motor Vehicle Administrators (AAMVA) groups document-related identity fraud into three threats: counterfeiting (“producing a simulation of the genuine document”), falsification (altering the holder’s details on a genuine card, or reusing parts of genuine cards) and misuse of a genuine document, such as “posing as the rightful holder.” In a remote flow, those show up as:
- Counterfeits. A card made to look like a real state license or ID.
- Altered genuine cards. A real card with a changed name, date of birth or photo.
- Genuine cards obtained with false information. The standard defines an impostor as a person who applies for and obtains a license or ID card “by assuming a false name and identity.” The card itself is real, so catching this depends on signals beyond the document.
- Digitally generated documents. In Alert FIN-2024-Alert004 (November 13, 2024), the Financial Crimes Enforcement Network (FinCEN) said some financial institutions reported criminals using generative artificial intelligence (AI) “to alter or generate images used for identification documents, such as driver’s licenses or passport cards and books.” FinCEN added that criminals have combined these images with stolen or fake personal information to create synthetic identities.
- Photos of screens or printouts. An image of a copy rather than of the physical card, which can hide the fact that no real card exists.
What document fraud detection can and can’t do from a photo
Federal REAL ID rules require states to build cards with three levels of security features: level 1 for “cursory examination, without tools or aids,” level 2 for “examination by trained inspectors with simple equipment,” and level 3 for “inspection by forensic specialists.”
A remote reviewer works with less than level 1. You can’t feel raised or tactile print, you can’t shine a UV light, and a single still image can’t show how a hologram or color-shifting ink changes as the card tilts.
The National Institute of Standards and Technology (NIST) identity proofing guidelines, SP 800-63A-4 (July 2025), accept “visual inspection by trained personnel for remote identity proofing” and “automated document validation processes using appropriate technologies” as ways to validate identity evidence.
How to tell if an ID is fake from a photo
No single check is conclusive. Used together, these are the most practical answers to how to spot a fake ID when you can’t hold it.
1. Compare the front with the barcode
Cards that follow the AAMVA standard carry a two-dimensional barcode in a format called PDF417 on the back. Its mandatory fields include the cardholder’s name, date of birth, issue and expiration dates, license number and document discriminator (the card-specific “DD” number). NIST says that when a barcode is present, automated document inspection “SHALL compare” its data with the printed data for consistency. A mismatch is a strong reason to look closer. Allow for format differences, though: the AAMVA standard notes that printed and encoded data are “at times” not identical, and barcode dates are written without slashes.
2. Run format and logic checks
- Dates. Birth should come before issue, and issue before expiry. Check expiry against your policy: FinCEN’s deepfake alert notes that under the Customer Identification Program (CIP) rule, financial institutions may collect “an unexpired government-issued identification.”
- Age vs. portrait. FinCEN lists as a red flag a photo inconsistent with other details, such as when “a customer’s date of birth indicates that they are much older or younger than the photo would suggest.”
- Age vs. layout. The AAMVA standard calls for a vertical card for U.S. cardholders under 21 and a horizontal card for those over 21. A layout that doesn’t fit the age on the issue date deserves a second look.
- Design vs. issue date. Florida began issuing a new card design on September 30, 2026, while older cards stay valid until they expire. A card in the new design with an issue date before late September 2026 deserves a closer look.
3. Compare the layout with the state’s genuine design
The AAMVA standard cites estimates of valid design variations “well in excess of 200” across its members, and notes that states “rarely if ever replace all existing cards” when they start issuing a new design. Use the issuing state’s own published guides where they exist, and check that a REAL ID marking, if present, sits on the upper top portion of the card, as the Transportation Security Administration (TSA) describes in its REAL ID FAQs. FinCEN’s notice on counterfeit U.S. passport cards says genuine passport cards are laser engraved, producing “a clear and crisp grayscale portrait image,” so a color portrait is a red flag you can see in a photo.
4. Look for signs of editing
Check for text in a different font, size or sharpness from the rest of the card, fields that don’t line up, blurring or color shifts around the name, dates or portrait, and a portrait with edges that look pasted in. FinCEN’s red flags include a photo that “shows visual tells of being altered.” The alert also describes institutions examining an image’s metadata and running reverse image searches, which may show that an ID photo matches an image in an online gallery of AI-generated faces. Treat metadata as one signal, not proof.
5. Make sure it’s a live capture of a physical card
A photo of a screen or a printout can stand in for a card that doesn’t exist. For automated document validation, NIST’s guidelines call for live capture and document presence checks that “confirm that the document is physically present and that the image captured during the identity proofing session is not a manipulated digital copy.” Visual cues include moiré patterns or pixel grids, screen edges or reflections, and paper texture. NIST also warns about injection attacks, where forged images are inserted between the camera and the system, and calls for controls such as detecting a virtual camera.
6. Compare the portrait with a live selfie
Compare the ID portrait with a selfie captured live in the same session, not with an uploaded photo. FinCEN’s alert names live verification checks, where a customer is prompted to confirm their identity through audio or video, as a good practice. The same alert flags customers who use a third-party webcam plugin or who claim repeated technical glitches during a live check.
7. Look for the same document or face across applications
FinCEN’s alert lists “patterns of apparent coordinated activity among multiple similar accounts” among the indicators that may warrant further due diligence on existing accounts. Checking new applications against past ones for a repeated document or face can help surface related accounts at the start. NIST cautions against declining anyone on an automated one-to-many biometric match, such as a face search, without manual review, noting that twins can match legitimately. In Securely Verify’s identity verification, anti-spoofing checks frames for screens, printouts and masks, and fraud signals include duplicate faces and documents and edited or old photos.
Checking an ID in person
When the card is in your hand, you can use the features a photo can’t show. FinCEN’s passport card notice groups its tips into checking “visually,” “visually and by touch,” and “with magnification or ultraviolet light.” For example, the date of birth on a genuine U.S. passport card has a distinct texture, and a holographic feature should animate when tilted. Florida’s 2020 retail guide does the same for its pre-2026 license design: tilt the card to see a ghost image, backlight the look-through element, feel the tactile feature and check the UV ink under 365-nanometer light.
What to do when you suspect a fake ID
- Don’t accuse. A mismatch can have an innocent cause, such as glare, a blurry capture or format differences between the front and the barcode. FinCEN describes its indicators as “not conclusive of inauthentic documents” in its deepfake alert.
- Ask for a retry or another document. A neutral request for a clearer capture, or for a second ID, gives an honest applicant a fair chance. NIST expects identity services to document how they handle errors, including when an applicant “is unable to capture a clear image of their identity evidence.” On Growth and higher plans, reviewers in Securely Verify can request a retry, and document collection lets you ask for another document through one link.
- Record the reason. Write down what you saw and why you decided as you did, so the decision can be reviewed later.
- Consider your reporting obligations. Under the Code of Federal Regulations (CFR) at 31 CFR 1020.320, a bank must file a suspicious activity report (SAR) for a transaction conducted or attempted by, at or through it that involves or aggregates at least $5,000 in funds or other assets when it knows, suspects or has reason to suspect the activity fits the rule’s categories. The filing is generally due within 30 calendar days of initial detection. FinCEN’s alert notes that “bank” in these rules includes credit unions, and asks filers to include the key term “FIN-2024-DEEPFAKEFRAUD” for activity connected to the alert. Confirm with your compliance team or counsel how this applies to you.
If you want to try these checks on your own applicants, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions, FIN-2024-Alert004 (FinCEN, November 13, 2024); FinCEN Notice on the Use of Counterfeit U.S. Passport Cards, FIN-2024-NTC1 (FinCEN, April 15, 2024); 2025 AAMVA DL/ID Card Design Standard (AAMVA, June 2025); NIST SP 800-63A-4, Digital Identity Guidelines: Identity Proofing and Enrollment (NIST, July 2025); 6 CFR 37.15, Physical security features for the driver’s license or identification card (Electronic Code of Federal Regulations (eCFR), current as of September 23, 2026); 31 CFR 1020.320, Reports by banks of suspicious transactions (eCFR, current as of October 13, 2026); Florida Driver License and ID Card Retail Guide (Florida Department of Highway Safety and Motor Vehicles (FLHSMV), August 2020); Florida Launches Newly Designed Driver Licenses and Identification Cards (FLHSMV, September 29, 2026); REAL ID FAQs (TSA, accessed October 2026). This article is general information, not legal or compliance advice.
