How do you spot a fake ID?
Run the 60-second physical routine first: tactile relief on the date of birth or signature, UV features, and the card edge. Then cross-check the data rather than the document — scan the PDF417 barcode and compare it against the printed front. US businesses with access can validate fields directly with the issuing DMV through AAMVA's DLDV service.
This guide is for anyone whose business accepts government IDs: door staff, retail teams, notaries, and the product managers building onboarding flows. It gives you a physical inspection routine, the cross-checks that catch "scannable" fakes, and the escalation path when a document fails.
Know what you're up against
Fake IDs stopped being a craft project years ago. Current counterfeits ship from professional operations with holograms, UV features, and encoded barcodes that scan clean on basic readers. The listings advertise "scannable" as a standard feature, take group discounts, and turn orders around in about two weeks.
That changes the job. A fake that looks right and scans right will pass any check that only looks and scans. The checks below are ordered by how hard they are to counterfeit: feel first, then light, then data, then the face.
Run the 60-second physical routine
Work through the document in this order. Each step catches what the previous one misses.
- Feel it before you read it. A real license is a single rigid polycarbonate or laminated card. Fakes give themselves away at the edges: peeling layers, glue lines, a card that bends too easily or feels too thick. Run a thumbnail along the edge
- Feel for raised print. Many states print the date of birth or signature with tactile relief. Flat where it should be raised is a fail
- Tilt it. Genuine holograms and color-shifting ink change appearance smoothly as the card moves. Printed imitations just glare
- Backlight it. Hold the card up to a bright light. Several states cut laser perforations (shapes or state outlines) that only appear when lit from behind. Check what the issuing state's current design should show; the AAMVA design references and each DMV publish this
- Check the microprint. Under any magnifier, real microprint stays crisp lettering. Counterfeit microprint blurs into a line
- UV if you have it. A $10 UV torch reveals features most counterfeiters still skip
Ten seconds per step. The order matters: fraudsters optimize for the checks people actually run, and most people only look.
Cross-check the data, not just the document
"Scannable" means the barcode decodes. It does not mean the barcode agrees with the card. That mismatch is where fakes fail:
- Decode the back barcode and compare every field to the front. Name, date of birth, license number, expiry. Cheap fakes encode template data and print custom fronts: any mismatch is a hard fail.
- Check the document number format. States follow fixed patterns for license numbers. A California number with the wrong structure fails no matter how good the hologram is.
- Do the math on the dates. Issue date before the format existed, an expiry more than the state's maximum term away, a 21st birthday that happens to be last week. Fraudulent documents cluster around convenient dates.
- Where stakes are high, verify against the source. US businesses with access can check license data against AAMVA's DLDV service, which validates fields directly with the issuing DMV. A perfect counterfeit still fails the database check, because the record doesn't exist.
Match the human, not just the card
The strongest fake ID in circulation is a real one: borrowed, bought, or stolen, with someone else's face on it. Photo comparison by eye fails more often than teams expect, especially across lighting, age gap, and a queue of impatient customers.
- In person: compare fixed features (ear shape, hairline, the distance between the eyes), not the haircut or glasses.
- Online: photo-of-a-photo is the baseline attack. Automated verification pairs the document portrait against a live selfie with liveness detection, which catches both the borrowed card and the replayed screen. This is the check that ends the borrowed-ID business, and it's the one manual inspection can't replicate.
When a document fails
- Don't announce which check failed. Every explanation you give is free product feedback for the counterfeiter
- Decline the transaction per your policy; whether you confiscate or return the document depends on your state's rules, so have that answered before it happens, not during
- Log it: date, document details, photos if policy allows. Repeat attempts cluster, and your log is how you see the pattern
- For regulated businesses, feed the failure into your fraud review, and check whether the same identity appears elsewhere in your customer base
Scale past the naked eye
The routine above holds up at a door. It does not hold up at ten thousand signups a month, and it was never designed for remote onboarding, where there is no card to feel. Automated document verification runs the same checks (template match against the state's real design, barcode-to-front consistency, tamper detection) plus the biometric match, in seconds, identically every time.
For the hiring version of this problem, see detecting candidate fraud. For wiring verification into your signup flow, see how to integrate a KYC API. Age-restricted businesses should start with Verifa's age verification, which pairs document checks with selfie-based age estimation. For the selfie side of the same check, see liveness detection.