How to Tell if a Government ID Is Real or Forged

The arms race has three eras. From the 1990s to the early 2010s, governments added security feature after security feature: holograms, microtext, UV-reactive overlays, laser perforation, polycarbonate substrate, machine-readable zones. Forgery was expensive and required specialist equipment.

From 2018 to 2023, generative image models collapsed the cost of producing a believable photo. The cost of producing a passport photo that passes a casual visual check fell by roughly two orders of magnitude. Detection lagged for about eighteen months.

Since 2024, forensic AI has closed most of the gap, but on a different surface. Visual security features still matter for in-person inspection; the AI work happens on the image, metadata, and biometric layer.

These are the physical checks, in roughly the order a trained inspector performs them. The order matters because each later check assumes the document survived the earlier one.

Run a thumbnail across the date of birth, document number, and signature. Real polycarbonate, the substrate of most modern IDs, has uniform raised printing produced by laser engraving. The tactile relief is consistent and bidirectional. A flat surface, or one that feels raised in one direction only, points to inkjet or thermal-transfer reproduction on a polyester laminate.

A second tactile cue: the laser-engraved tactile portrait. A real polycarbonate card has a faint relief in the portrait itself, visible at a low-angle inspection. Counterfeits flat in this region pass to the next check.

Tilt the card under a light source. A real hologram shifts smoothly through multiple registered images. OVI (optically variable ink) on the country emblem or document number shifts color (gold to green, for example) with angle. A static, monochrome, or unevenly registered hologram points to a stick-on overlay.

Each issuing authority has a distinct hologram pattern. The free reference for inspectors is the Edison TD database for travel documents and the AAMVA reference manuals for US licenses, both publicly catalogued.

Hold the card or passport bio page up to a strong light source. A real document reveals a translucent ghost portrait aligned with the primary photo, plus laser-perforated patterns that form the country emblem or state seal. A counterfeit usually fails the perforation pass, since reproducing laser perforation requires specialist equipment.

The MRZ at the bottom of a passport bio page is two or three lines of fixed-format text. ICAO 9303 defines the format and the check digits. There are five composites to verify: the document number, date of birth, expiry, optional data, and a final overall checksum. Each is computed with a fixed weighted-modulo formula (digits multiplied by 7, 3, 1, 7, 3, 1, summed, mod 10).

A mismatch is conclusive evidence of alteration. A pass is necessary but not sufficient: a sophisticated forger recomputes the check digit. The free implementations are everywhere, and the algorithm fits in a hundred lines of code.

US driver’s licenses carry a PDF417 barcode on the back, standardized by AAMVA. The payload contains the same biographic data printed on the front. A barcode that decodes to a different name, DOB, or address is the most common tell on altered licenses, because forgers update the printed face but rarely re-encode the barcode.

Any USB barcode scanner reads the payload. Most ID-verification apps do this automatically and surface the mismatch as a first-class warning.

Modern passports and many national IDs carry an NFC chip that holds the bio data, the portrait, and a cryptographic signature from the issuing authority. Reading the chip requires Basic Access Control or PACE, both keyed to the MRZ. The chip read is the closest thing to a definitive authenticity verdict that exists for travel documents today.

The pre-condition is having the document and a reader. A photo of an ID, no matter how high resolution, cannot pass the chip check.

Two failure modes resist physical inspection: AI-generated portraits and image-only fakes (a screenshot or PDF rather than a physical card). Forensic AI catches both.

For AI-generated portraits, the engine looks for GAN and diffusion fingerprints in the frequency domain, statistical pixel-distribution anomalies (real cameras produce a characteristic noise profile that generative models do not reliably reproduce), and inconsistencies in lighting between the portrait and the document substrate. Detection rates on published benchmarks sit above 99 percent on current generative models, with a few-percent false-positive rate on low-resolution authentic scans.

For image-only fakes, the engine inspects PDF producer metadata, EXIF, edit history, and runs Error Level Analysis across the image. Photoshop and InDesign producer strings on a document that should have come from a government scanner or kiosk is decisive. Our photoshopped document detection guide walks the metadata logic in depth.

Across document types, the principle is the same: there is always one check the forger cannot reproduce cheaply. The inspector’s job is to find it before any other check.

Most physical fakes ship without a backstory. The five questions that catch inattentive forgers in seconds: What is your zip code? What is your middle name? What was your birth year? What address is on this card? What is the expiry date? A holder of a real ID answers without hesitation. A presenter of a fake hesitates on at least one, usually the address.

Behavioral checks supplement forensic checks. They are not a substitute. In high-volume contexts (bars, casinos), the forensic check via barcode scanner is the workhorse, and the behavioral check is the escalation.

Two contexts. First, any verification that happens off the physical document (online KYC, remote onboarding, insurance claims, hiring, education). The physical checks are impossible by definition, and forensic AI replaces them rail-by-rail.

Second, high-volume in-person verification where the inspector cannot examine every document carefully (border control, airport security, large-venue admission). The workflow is automated: barcode scan, AAMVA payload validation, image upload to a forensic engine, verdict in under a minute. The human role shifts from inspection to exception handling.

Our AI document verification primer describes the engine that handles both. The five-layer pipeline runs the same way for an ID as for a diploma; the feature library is different.