Trends in Identity Document Forgery

Identity fraud has existed since the first ID documents appeared. There are dozens of tricks and techniques criminal entrepreneurs use. The basic ones are:

• Manual alteration. This involves original documents issued by legal authorities and stolen from their original holders. Fraudsters change or erase some identification elements like a photo or name in the physical document. They can also add fake entry/exit stamps in passports with visas. Altered documents are also called forged.

• Counterfeiting. Some fake documents are made from scratch. To produce a compelling physical passport or ID cards, fraudsters can reach out to unscrupulous companies that produce security features, who will then provide them with access to authentic stamps, holograms, ink patches, and UV dull paper. They can also use empty obsolete blanks of documents as a canvas.

• Computer simulation. Democratization of digital technologies has led to the rise of synthetic identity fraud (combining original data with fake). Another widespread technique involves selling empty ready-to-use blanks referring to a particular type of identity document. Also, there are digital services that allow one to make an ID card or driver's license from scratch. Since the process typically takes a couple of minutes and the result costs as low as $10 per item, many forgeries are produced this way. Unfortunately, such handcrafts might look compelling enough to deceive some identity verification systems.  

• AI-generated documents. Generative AI enables fraudsters to produce realistic-looking identity documents in large volumes, rapidly creating different portraits, personal details, backgrounds, and document layouts. These documents can be combined with deepfake masks designed to impersonate the document holder and bypass identity verification checks.

Sometimes criminals mix these methods.

Fraudsters use fake identity documents to impersonate another person, conceal their real identity, or create an entirely new one. Such documents can facilitate irregular migration, but their uses extend much further. They may also help criminals open financial accounts, obtain loans, register businesses, secure employment, access government services, rent property, or support money laundering, human trafficking, and other offenses.

The documents fraudsters choose to imitate are influenced by two main factors: their value and the difficulty of counterfeiting them. Passports and ID cards from economically attractive countries or regions are in high demand because they may provide broader travel opportunities, residence or employment rights, and easier access to financial and public services.

However, documents offering similar practical benefits can differ significantly in their construction and security.

However, there are other factors influencing the identity counterfeit market. 

Let’s take as an example a current Spanish passport. It provides extensive international mobility as well as freedom of movement within the EU and Schengen area, but it features a paper-based data page and rather traditional security features — watermarks, security threads, microprinting, inkjet printing of the passport holder’s portrait, offset printing, etc.

By comparison, the current German passport series features a polycarbonate biodata page with laser-engraved personal information and numerous advanced security features. These include optically variable ink (OVI), clear windows, multiple laser image (MLI), and an extensive number of holograms across the entire page.

This difference creates a trade-off for fraudsters. Both passports are highly valuable, but reproducing the physical structure and dynamic security features of a polycarbonate document can require more sophisticated equipment and expertise. A paper-based biodata page may be easier to imitate visually, particularly when a verification system examines only a photograph or scan. However, copying the document’s appearance does not create a genuine RFID chip or a valid digital signature.

Consequently, fraudsters do not always create complete counterfeits. They may alter genuine documents, substitute photographs, use stolen passports belonging to people with a similar appearance, or manufacture visually convincing copies intended specifically for remote verification. In some cases, they assemble an entire identity package containing a passport, ID card, driver’s license, residence permit, and supporting documents under the same false identity.

Demand is therefore determined not simply by a country’s wealth, but by a combination of the document’s practical value, availability, physical construction, security features, and the verification controls it is expected to encounter.

Border control and transportation are among the areas where fake documents are frequently encountered, as fraudulent passports, visas, residence permits, and ID cards may be used to cross borders or travel under another identity. In a 2024 Europol-supported operation in Greece, authorities seized 4,650 fraudulent documents from a criminal network connected to migrant smuggling. INTERPOL’s database also contains approximately 138 million records of travel and identity documents reported as lost, stolen, revoked, invalid, or stolen blank. 

Financial services — including banking, fintech, cryptocurrency, and insurance — are also frequent targets. Fraudsters may present fake documents to open accounts, obtain credit, receive insurance payouts, launder money, or take control of accounts belonging to legitimate customers. Telecommunications providers face similar attacks involving the registration of mobile numbers, device financing, and SIM-swap fraud. 

Other exposed sectors include e-commerce, online marketplaces, car rental, hospitality, gaming, healthcare, education, and public services. These organizations may collect identity documents without having the same document expertise, specialist equipment, or access to government databases as border authorities. Unfamiliar foreign documents can be particularly challenging for employees who normally encounter only domestic IDs. 

Remote onboarding creates an additional layer of risk. Fraudsters can submit manipulated scans, screen images, fully synthetic documents, or AI-generated identity documents without presenting the physical original. They may combine these documents with deepfake masks or manipulated video designed to impersonate the supposed holder during facial verification. 

For this reason, checking only the text, photograph, and general document layout is no longer sufficient. Modern verification should examine dynamic security features — elements that change when the document is tilted, rotated, or exposed to different lighting conditions. Capturing these effects helps determine whether the user possesses a physical document rather than a printed copy or an image displayed on a screen.

The bad news is that, one day, a fake or counterfeit ID card, passport, or driver’s license might be in your customer verification flow. 

The good news is you can keep your systems secured and fraud-free by following these practices:

When creating forgeries, fraudsters focus more on visual similarity with original identity documents. But they often leave out essential details that are undetectable to the naked eye. This is where automated identity verification and document-authentication solutions become essential.

Biometric passports and ID cards are particularly difficult to counterfeit because they contain contactless RFID chips that can be read using NFC-enabled devices. Fraudsters may alter visible information, such as the holder’s name or photograph, while the original data remains stored in the chip. NFC-based verification can expose these inconsistencies by comparing the chip data with the visual inspection zone (VIZ) and machine-readable zone (MRZ). The facial image stored in the chip can also be compared with the printed portrait and with the person completing the verification. Learn more about RFID verification.

If you have a reliable tool, you can recognize inconsistencies in the visual inspection zone (VIZ), tiny alterations in the machine-readable zone (MRZ), and lack of security features, like photos or lenticular images. That’s what document readers do. Plus, many authenticity checks are available for digital onboarding scenarios involving identity verification as well.

As more identity verification sessions are done online, you need to avoid loopholes in your systems that attackers can exploit.

A well-architected identity verification solution usually has a server-side part where all checks are conducted in addition to the checks done on a smartphone. One component pulls data from users, such as a customer's ID scan or selfie, and sends it to the company's server, where a second component performs a set of authentication checks.

This approach guarantees that you will examine the very information the users provide you with in real time, not a third-party data pack dropped by fraudsters. That’s why SDKs can be a more secure option than APIs.

Equipped with a slew of complex security features, biometric identity documents are least likely to be faked, which explains their growing prevalence. 

Although biometric fraud is often unsophisticated, you should still be on guard. Fraudsters come up with tricks that work in unsecured remote sessions. Luckily, many attacks with fake printed photos, video replays/injections, and 3D masks, are detected during liveness checks. This enables you to verify the realness of an image, whether it is a portrait or a scan of a passport.

Let’s have a look at Regula ID verification SDK to see how this process might work in the real world. While checking the document liveness, the software verifies the presence of dynamic security features, and performs a screenshot/electronic display check. Also, it matches the photo in the document with a selfie to ensure only real people access your service using a genuine physical document. This is also true for multi-factor authentication, including biometric factors like face matching.

In remote scenarios, you can track a customer's IP address as they transmit their data to your systems. Further, you can create a blacklist of suspicious IPs to stop sessions and block traffic from them in the future. 

For example, a session involving a client with a South African or Indonesian IP claiming to be a resident of Brazil should be red-flagged. Additionally, it’s worth paying attention to repeated attempts to get into your system from the same location. You also need to keep a watchful eye on situations when you receive repeated data from different geographies.

Governments regularly update identity documents to cope with growing fraud. This means that any reliable identity verification tool must keep several versions of each ID card and passport in its database. Then, you will be notified when a customer presents an obsolete document that has already been taken out of circulation, if the document contains data inconsistencies, or if signs of forgery are detected.

An extensive document template database is also a protection against false positives. Since we live in an era of digital nomads, one day you may have to verify a driver’s license or passport issued outside your country.

How large should the database be? It depends on the scenario. The most comprehensive in the world is the one we maintain at Regula: it includes over 16,000 templates, and can cover almost any use case.

With the constant advancement of technology, fraudsters have become more sophisticated at forging identity documents.

While governments and law enforcement agencies continue to improve the security features on these documents to make them more difficult to forge, businesses should be vigilant and take necessary measures to prevent identity theft and fraud. This includes verifying the authenticity of identity documents before accepting them as valid. Regula solutions can serve as a good starting point.