The fake US passport card carried Arlene Sands' photo with the name and date of birth of one of two people who held a credit union account, and in February 2023 Sands used it to try to withdraw $17,000 from that account. Credit union staff did not complete it. On 31 August 2026 Sands was sentenced to 25 months for bank fraud, false use of a passport and aggravated identity theft (US Attorney's Office, District of Maine, 1 September 2026).
Document fraud is making, altering or misusing a document to deceive, and with an ID it often serves identity theft and the identity fraud that follows. Forensic document examination studies such a document for a court. Document fraud detection is the firm's own check, one layer of fraud detection and prevention.
What is forensic document examination, and how does document fraud detection differ?
Forensic document examination establishes, for a court, where a document came from and whether anyone changed it. NIST's OSAC Forensic Document Examination Subcommittee works on standards for "the forensic analysis, comparison, and evaluation of documents". Its registry lists the standards examiners follow, among them one for examining documents for alterations (added 4 March 2025).
A bank's or fintech's check is narrower. NIST SP 800-63A-4 (July 2025), the identity proofing guideline written for US federal services, requires evidence to be validated as authentic, "not forged or altered", by trained personnel, automated document validation or cryptographic verification, and it has proofing agents reassessed every year. The check ends in accept, reject or escalate.
Picture an onboarding analyst (illustrative) who sees a passport photo under a second laminate, one of the Home Office's signs of a substituted photo. The analyst does not have to prove a forgery. The account stays closed and the file goes to the fraud lead. An examiner comes in if the case moves to a prosecution or a civil claim, and in a corporate fraud dispute the document may be a contract or a signature.
What are the four types of document fraud?
The District of Maine release calls the Sands card fake and does not say how it was made. The Home Office guide Examining identity documents, written by its National Document Fraud Unit, sorts document abuse into four types. A card printed from scratch is the second type, a counterfeit, even when the person showing it poses as someone else.
- Impersonation. A real document shown by someone who resembles its holder; the document passes and the face, age or signature does not.
- Counterfeit. A complete reproduction made from scratch; print quality under a magnifier, a bright glow under UV light and a generic hologram give it away.
- Forgery. A real document unlawfully altered with a substituted page, a substituted photo or changed personal details; damage around the photo or the date of birth shows it.
- Pseudo or fantasy document. It looks like a passport or ID card but has no legal basis, so it cannot be found on PRADO or EDISON.
The guide also names four motives for abusing an identity document: illegal working, immigration abuse and two fraudulent activities, financial fraud and benefit fraud.
How do you check a document for fraud, layer by layer?
To check a document for fraud, take it through six layers. A forgery can fail at any one of them, and each layer has a test that a regulator or standard setter wrote down.
Table 1. Six layers of a document check (who decides varies by firm)
| Layer | What a forgery looks like | What the check inspects | Source | Who decides |
|---|---|---|---|---|
| 1. Capture | A photo of a screen, or an edited digital copy | Live capture and document presence; image sharp enough to read | NIST SP 800-63A-4; EBA guideline 33(d), (e) | IDV provider |
| 2. Template and security features | Wrong typeface, flat print, a hologram that does not shift | Layout, characters and features against a genuine specimen | EBA guideline 33(a); Home Office Checklist A; FinCEN notice p. 5 | IDV provider; trained staff in person |
| 3. Data and photo integrity | A swapped photo, a scraped and rewritten date of birth | Page and photo substitution; machine readable zone against the print | Home Office Checklist B; NIST SP 800-63A-4 | IDV provider |
| 4. Holder | A real ID in someone else's hands | Face against photo, apparent age, signature | Home Office impersonation checks; FinCEN notice pp. 5 to 6 | IDV provider; branch staff |
| 5. Cross checks | Details that match no other record | Other IDs, the customer profile, the chip data | FinCEN alert p. 4; 31 CFR 1020.220 | Fraud analyst |
| 6. Second review and escalation | A fake that passed at onboarding | Accepted files reviewed again; reverse image search; referral | FinCEN alert p. 3; OSAC standards | Fraud analyst; examiner |
For a remote check, layer 1 comes first. NIST requires credential service providers to use live capture and a document presence check so that the image "is not a manipulated digital copy". Where an EU bank or financial institution accepts a reproduction instead of examining the original, EBA/GL/2022/15 guideline 33 asks it to establish that the copy is clear enough for the relevant information to be "unambiguous" and was not displayed on a screen.
Layer 3 is arithmetic as much as eyesight. Where a passport carries a machine readable zone with its check digits, NIST requires the optical inspection to compare it with the printed data.
Layer 6 looks back at files already accepted. FinCEN found that firms "often detect GenAI and synthetic content in identity documents" by reviewing account opening documents again, and that a reverse image search can match an ID photo to an online gallery of generated faces (FinCEN deepfake alert, 13 November 2024, p. 3).
How can software detect document tampering?
Software detects document tampering automatically by comparing the image with a known template, reading the security features a camera can capture, matching the machine readable zone to the print and testing that the capture is live. FinCEN names two more techniques that firms and their identity verification providers can use: examining an image's metadata and "using software designed to detect possible deepfakes or specific manipulations" (p. 4).
NIST SP 800-63A-4 asks credential service providers to have their document validation technology tested independently and to publish the results, a fair request to any document fraud detection system vendor. Automated document tampering detection cannot feel raised print, and NIST lists tactile inspection only for proofing in person. Whether a real document belongs to its bearer is the face check of layer 4.
What gives a forged ID away?
These red flags come from FinCEN and the Diplomatic Security Service, written for counterfeit US passport cards (FinCEN Notice FIN-2024-NTC1, 15 April 2024, pp. 5 to 6). The first four describe the card itself; the other four can be read against any ID.
- A photo with a white, blurry border, or in color. Real passport cards are laser engraved in grayscale.
- Flat text. On a real card, text such as the date of birth feels raised.
- A missing or foreign seal. The holographic State Department seal is absent or comes from an unrelated agency.
- A blurry second portrait. On a real card the smaller portrait is microprinted with the holder's details.
- A signature unlike the one on file. Compare it with the signature card the branch holds.
- A customer who cannot give a date of birth. Or who knows it but not the account, and asks about balances and withdrawal limits.
- Directions by phone. A third party appears to be steering the visit.
- A photo with "visual tells of being altered", or IDs that disagree with each other. From the deepfake alert (p. 5).
Read against the notice's financial flags, the Sands attempt matches the first: a passport card as identification, then a large cash withdrawal. The release does not say what made staff stop, so that reading is illustrative.
How are authorities fighting document fraud?
The Sands card was one case in a pattern. Since 2018 the Diplomatic Security Service has seen a rise in counterfeit passport cards used in person to get into victims' accounts, and it assesses that from 2018 to 2023 these schemes caused "$10 million in actual losses and $8 million in additional attempted losses, with over 4,000 victims" in the US (FinCEN notice, p. 1). FinCEN asks firms to put the key term FIN-2024-NTC1 in SAR field 2, select field 34(z) and write "Passport Card" in its text box.
Interpol works at borders. Its Stolen and Lost Travel Documents database holds around 138 million records of travel and identity documents reported stolen, lost, revoked or invalid, and officials searched it 3.6 billion times in 2023, with 232,423 hits.
The DSS investigated the Sands case with the Portland Police Department. In the UK, the Home Office tells anyone who meets a suspected false document to contact the police or the local immigration enforcement office.
Four document fraud dates from 2026
- 26 February. The creator of OnlyFake, a site that sold photos of fake passports and driver's licenses, pleaded guilty in New York to conspiracy to commit fraud in connection with identification documents (US Attorney's Office, SDNY).
- 4 August. OSAC added a technical report on forensic document examination terms and definitions to its registry.
- 31 August. Sands was sentenced to 25 months in Portland, Maine.
- 21 October. The Home Office uploaded an updated version of its guide to examining identity documents, the edition this page cites. It lists five UK passport styles in circulation and says eVisas have taken over from physical immigration documents.
Where is document examination used to curb fraud?
Banks come first. The US customer identification rule (31 CFR 1020.220) asks each bank for procedures that give it a "reasonable belief" in who its customer is, and it lists verification through documents before verification without them.
Immigration departments check passports, visas and residence documents, and the Home Office guide points employers and landlords to the right to work and right to rent checks. National and international courts hear the examiner, and OSAC's proposed standard for expressing source opinions shapes how an examiner words a finding. Educational institutions check diplomas and transcripts for the same signs of counterfeiting and alteration.
How are bank statements, payslips and company documents checked?
Supporting documents fail in different places from IDs. A bank statement or utility bill is checked against the issuer's layout and the file's metadata. A payslip is checked by arithmetic (illustrative): gross pay less deductions should equal net pay, and the net figure should reach the bank statement on the pay date.
Company certificates go to the registry. A forged one carries a number or details the register does not hold, and that lookup is how forged documents are detected in KYB verification.
Which rules decide how a firm checks a document?
Three rule sets shape a firm's document check, and compliance with none of them requires forensic examination.
Table 2. Document checks by jurisdiction (as of October 2026)
| Rule for the firm's check | Reference for a genuine document | Offense for a false document | Where a suspected false document goes | |
|---|---|---|---|---|
| US | 31 CFR 1020.220 for banks; NIST SP 800-63A-4 for federal services | State Department features, as shown in FinCEN's passport card notice | 18 U.S.C. 1028(a)(1); 18 U.S.C. 1543 for passports | A SAR with FIN-2024-NTC1 or FIN-2024-DEEPFAKEFRAUD |
| UK | MLR 2017 reg 28(2)(b) | The Home Office guide; PRADO or EDISON images | Identity Documents Act 2010 s4 | The police or immigration enforcement |
| EU | EBA/GL/2022/15 guideline 33, for copies accepted instead of originals | PRADO | National law; in Germany, StGB s267 and s281 | National rules (not covered here) |
One clause of the US rule fits the passport card case. A bank's procedures for verifying without documents must cover cases where "the bank is not familiar with the documents presented", and FinCEN says criminals counterfeit passport cards because they are "a less familiar form" of US government ID (notice, p. 2).
Guideline 33 asks a firm that relies on a copy to compare its security features and its "type, size of characters and structure" with official databases such as PRADO, the Council's Public Register of Authentic identity and travel Documents Online. In the UK, regulation 28(2)(b) requires the firm to "verify the customer's identity" but sets no forgery test, and the Home Office guide lists the checks for anyone presented with an identity document.
The offenses fall on the person. They include producing a false identification document under 1028(a)(1), forging or using a false passport under 18 U.S.C. 1543, holding a false ID with an "improper intention" in the UK, and forging documents in Germany (up to five years or a fine for the basic offense).
Who catches a forged identity document, and what sits outside it?
In KYC, a forged document is caught by up to four parties in turn: branch staff, as in the Sands withdrawal; the IDV provider, which runs the capture, template, data and face layers; the fraud analyst, who cross checks the profile, orders the second review and decides on a SAR; and, for a case headed to court, the examiner.
complead, formerly Sanction Scanner, works at the analyst's step. Document and biometric identity verification stays with the IDV provider, and the customer risk assessment and KYC model receives the verified identity "as an input" without generating it.
What complead adds is what a document cannot show. A forged card says nothing about the phone that uploaded it, and FinCEN counts device data inconsistent with the identity documents as a red flag (alert, p. 6). complead's device and behavior analysis recognizes a device after cookies are cleared, in private browsing or behind a VPN, and its fraud prevention engine approves, declines, sends to review or steps up the session. The analyst still decides on a document that looks wrong.
FinCEN also found that accounts opened with identities suspected to be made with GenAI were used to receive and launder the proceeds of other frauds (alert, p. 3). That is where fraud and money laundering meet, and why AML screening and the document check belong on one customer file.
This week, review a sample of last month's accepted IDs again; FinCEN found that firms often catch generated documents that way. Check your IDV provider's report against guideline 33 (a), (d) and (e), or your market's own rule. Write down who receives a flagged document and when it reaches an examiner. A document can pass every layer and still front an invented identity.
How this page was checked. Emirhan Akgün wrote it; Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, fact checks it, and the reviewed date is the day of that sign off. Read at source on 30 October 2026: the District of Maine release of 1 September 2026, FinCEN's passport card notice (15 April 2024) and deepfake alert (13 November 2024), the Home Office guide as uploaded on 21 October 2026, NIST SP 800-63A-4, the OSAC subcommittee page, EBA/GL/2022/15 and 31 CFR 1020.220. PRADO blocks automated reads, so its archived copy of 12 October 2026 was used.
