Document Fraud Detection: A Six-Stage Review Process

How do you detect document fraud?

Work six stages in order: classify the document against a template library, parse the machine readable zone and check its check digits, read the PDF417 barcode on the back against the printed front, inspect the file for screen photos and editor traces, verify with the issuing authority, then bind the document to the person presenting it.

You have a document in a queue and about thirty seconds to decide. This is the document fraud detection procedure for US onboarding, hiring, and compliance teams reviewing driver's licenses, passports, immigration documents, and the supporting paperwork that comes with them.

Work the stages in order. Each one kills a different population of fakes, and running them out of order wastes money on the expensive checks.

The pipeline, in order

Stage 1: build the template library before you need it

A classifier compares what it sees to a known design. If your library doesn't hold the design, you can't detect a deviation from it, and you're back to eyeballing holograms.

Your library needs three things for every document type you accept:

• The current design for all 50 states, DC, and the territories you serve
• Every older design still inside its validity window (licenses run up to eight years in most states, so three or four generations are in wallets right now)
• Interim and temporary paper credentials, which look nothing like the plastic and get rejected by naive classifiers every day

States reissue designs on their own schedule and rarely give integrators much warning. When a state ships a new card, expect your vendor's template to land weeks later. Set the rule now: an unrecognized design from a recognized state routes to human review with a second document requested, and it does not auto-decline. Track those routes weekly, because a spike in one state usually means a design change rather than a fraud ring.

For document types you have no template for at all, don't improvise. Publish a short accepted-document list and hold it. My recommendation: cut the list to the fewest types your regulator and your customers will tolerate. Every extra type you accept is a template you have to maintain and a forgery surface you can't inspect properly.

Physical security features (holograms, optically variable ink, laser-engraved photos, tactile printing) belong to this stage too, and they're covered step by step in how to spot a fake ID.

Stage 2: parse the machine readable zone

The machine readable zone is the block of monospaced characters at the bottom of a passport data page, on the back of a permanent resident card (Form I-551), and on an Employment Authorization Document (Form I-766). US driver's licenses don't carry one. They carry a barcode instead, which is stage 3.

Three formats matter:

• TD3: two lines of 44 characters. Passports and passport cards.
• TD2: two lines of 36 characters.
• TD1: three lines of 30 characters. This is the format most foreign national ID card designs use, and it's the one your reader is likeliest to mis-parse.

Each MRZ carries check digits computed over the document number, date of birth, expiry date, optional data, and a composite over the lot. The weighting cycle is 7-3-1 with a mod 10 result. Any parser worth using will compute these for you. What matters is what you do when one fails.

Most check-digit failures in a live queue are OCR misreads, not forgeries. The recurring pairs are 0/O, 1/I, 5/S, 8/B, and 2/Z, plus any character sitting under glare or a fold. Before you touch the decision, re-run the parse on a fresh capture: different angle, no flash, document flat. If the same field fails on a second, visually different image, you're looking at a document problem rather than a camera problem.

An MRZ line that comes back at 43 or 45 characters means one of two things: your reader dropped or doubled a character, or somebody retyped the zone by hand. A second capture tells you which. Fillers are <, never spaces, and the substitution is a common giveaway once the image is clean.

Then compare the MRZ against the printed data above it. Name, date of birth, expiry, document number, and issuing state should agree character for character. A forger who alters the printed date of birth and leaves the MRZ alone has handed you the answer.

Stage 3: read the PDF417 on the back

All 50 states and DC issue an AAMVA-standard PDF417 barcode on the back of their current driver's license and state ID designs. Territories, some older cards still inside validity, and paper interim credentials vary, so build your rule around the card in front of you rather than around "every."

Decode it and compare every field to the printed front: family name, given names, date of birth, expiry, issue date, document number, address, and the issuer identification number that should correspond to the state named on the card.

What this check kills: every forgery produced by editing the front of a genuine card, which is a large share of what arrives in consumer onboarding queues. It costs nothing per check once decoding is wired in, and it runs in milliseconds. What it misses: purpose-built fakes where the seller encodes the barcode from the same data they printed, so the two copies agree perfectly. Those are stage 5's problem.

When the barcode is absent, damaged, or won't decode after two captures, mark the document unverified and route it to stage 5. Do not record it as fraud. Worn cards in back pockets fail to scan constantly.

Mobile driver's licenses are a separate path. An mDL is presented device to device through a digital reader that validates the issuer's signature. A screenshot of an mDL screen is a photograph of a phone, and no amount of image analysis makes it a credential.

Stage 4: inspect the file, not just the picture

Open the file itself before you form an opinion about the image.

For PDFs (bank statements, payslips, utility bills, tax letters):

• Check whether the text layer is selectable. A statement generated by a bank has real text; a scan does not. A scan of something a bank generated digitally is a question worth asking.
• Look for a text object sitting on top of a white rectangle. That's an edit, and it shows up as a balance or a name that highlights independently of the line around it.
• Compare font metrics across the page. Three kerning styles in one payslip means three sources.
• Read the producer and creator metadata. Treat a graphics-editor producer string as one input to the score, since plenty of legitimate documents pass through print drivers and redaction tools.

For images of ID documents:

• Moiré patterns, a visible screen bezel, or a reflected room light mean you're looking at a photo of a screen rather than a document.
• EXIF that shows a desktop screenshot tool on a document the customer claims to have photographed is worth a re-capture request.
• Identical image hashes across two different applicants means the same file is being reused. Hash every accepted document and check new arrivals against the set.

Error level analysis deserves a warning. It degrades to noise after re-encoding, and phones re-encode everything. Don't build a decline rule on it.

Stage 5: verify against the issuer

Offline checks tell you the document is well made. Only the issuer tells you it exists.

For US documents, the sources worth wiring in:

• AAMVA Driver License Data Verification (DLDV) confirms whether the data you hold matches the state DMV record. It returns a match or no-match, not a copy of the record, and participation and permitted use vary by state. Confirm eligibility for your use case before you build.
• SSA electronic Consent Based SSN Verification (eCBSV) returns a match or no-match on SSN, name, and date of birth with the number holder's written consent. Enrollment and fees apply.
• USCIS SAVE for lawful status where you're an authorized user, and E-Verify for employment eligibility after hire under its own rules.
• The issuing registrar for diplomas, licenses, and certificates. Call the number you found on the institution's own website, never the number printed on the document.
• Direct bank data instead of statement PDFs. A read-only account connection removes the entire forged-statement category, because there's no file to edit.

Access to these sources is usually brokered through a verification provider rather than granted direct, which is what the checks inside KYC and AML software are doing under the hood. If you're building the plumbing yourself, how to integrate a KYC API covers the request and response handling. For company documents rather than personal ones, the registry procedure sits in how to verify a business (KYB).

Stage 6: bind the document to the person

A verified document proves a real credential exists. It says nothing about who is holding it.

Run a selfie match against the document portrait plus a liveness check, and run it last, after the document has passed stages 1 through 5. Order matters here: a failed liveness check on a real customer costs you an apology, while a passed liveness check on a fake document costs you a chargeback and an unpleasant audit conversation.

Set the match threshold from your vendor's ROC curve, pick the false-accept rate you're willing to defend to a regulator, and then measure the false-reject rate that comes with it against your own traffic rather than the vendor's benchmark. Demographic performance varies, so break the numbers out by cohort before you go live.

The re-capture rule: allow one automatic retry with fresh lighting. A second failure goes to a human reviewer, not an auto-decline. Give that reviewer a recorded challenge to run: turn the head slowly, hold the document beside the face, move the camera. Live face-swap rigs degrade under occlusion and head rotation. The same technique applied to hiring interviews sits in detecting candidate fraud in hiring, and the age-specific version is in how to verify age online. The economics that made those rigs cheap are in the deepfake economy.

Escalation table

Write these thresholds down before the queue gets busy. A reviewer improvising at 2am won't decide the same way twice, and you won't be able to defend either decision.

Red flags in supporting documents

Bank statements, payslips, and utility bills are proof of address, not proof of identity, and they're the easiest documents in the stack to fake. Templates for all three sell openly for the price of lunch.

• Balances that don't reconcile: sum the transaction column and compare it to the closing figure
• Round numbers in salary, rent, and closing balance all at once
• A payslip with tax and deduction figures that don't compute against the gross
• Address formatting that differs from the issuer's own template (wrong line breaks, wrong ZIP+4 style)
• A statement period that ends conveniently on the day before submission
• Two applicants at the same address with the same document producer metadata

Log what you decided and why

For every document, store the decision, the reason code, the stage that produced it, the reviewer ID if a human touched it, the image hash, and the timestamp. Encrypt the document images at rest and set a retention clock that matches your policy. Do not keep raw document images in an unsecured bucket because someone wanted them handy for disputes.

Where a rejected document suggests structured deception rather than a bad photo, US filing obligations may attach through FinCEN. The mechanism is fact-specific and the thresholds change, so route those cases to your compliance officer with the artifacts attached and confirm the current requirements against the regulator's own text.

Start with stage 3 this week. Barcode-to-front comparison is a decode and a string match, it runs on documents you're already collecting, and it removes the largest single category of edited cards before you spend a cent on issuer queries.