How to spot a fake ID: checks for onboarding teams

In August 2018, FinCEN added "Provided questionable or false identification" to the suspicious activity report (SAR) as a new option. A fake ID became its own reportable activity. In 2019, the first full year with that box, depository institutions marked it on 13,418 filings. By 2024 they marked it on 21,873, and money services businesses on 24,589, according to FinCEN's SAR statistics for the period to 31 December 2024 (one filing can list several activities).

The box turns an analyst's doubt at onboarding into something a filing can rest on. An onboarding desk rarely has the tools or the hours for a full document check. Its questions are narrower. Does the card match the standard its issuer printed it to? Is the holder the person on it?

What does a fake ID look like at onboarding?

On 27 January 2026, a federal judge in Arizona sentenced Muhammed Drammeh to 37 months in prison for conspiracy to commit bank fraud. According to the US Attorney's Office for the District of Arizona, the ring used victims' personal identifying information and fraudulent identifications to open phony business accounts linked to the victims' real accounts. It moved the money across and withdrew it in cash. Drammeh recruited others to impersonate the victims and supplied their fake identifications.

The cards in a scheme like that fall under the three threats of the AAMVA 2026 DL/ID Card Design Standard, the North American standard that licensing authorities design driver's licenses and ID cards to:

• Counterfeiting. A simulation of the genuine card.
• Falsification. A genuine card with the holder's details altered, or genuine parts reused in a new one.
• Misuse of a genuine document. A real card shown by someone posing as its holder, the pattern behind impersonation fraud.

In a Massachusetts ring whose guilty pleas were announced on 1 May 2026, the fake identification documents carried real customers' names and the imposters' photos, and the imposters presented them at the banks (US Attorney's Office, District of Massachusetts).

Two more forms matter at onboarding. FinCEN's deepfake alert of 13 November 2024 reports accounts opened with identity documents made with generative AI and then used as funnel accounts. AAMVA's threat annex adds a genuine card that is no longer valid. A synthetic identity is a different problem: it is assembled from real and invented details, so even a well made card describes nobody.

How do you spot a fake ID, document by document?

AAMVA's standard cites estimates that put the design variations of valid driver's licenses and ID cards among its members "well in excess of 200", which makes it "extremely difficult for law enforcement, or anyone else, to recognize a genuine license". The reference for each card is therefore its issuer's standard and specimen, read one document type at a time.

An identity verification (IDV) provider can run these checks in software. complead, formerly Sanction Scanner, leaves document and biometric checks to that provider: its customer risk assessment and KYC model takes the identity the provider verified as one input and does not generate it. Whether a pass is enough stays the analyst's decision.

Table 1. What to compare each ID against (standards read 12 November 2026)

How do you tell if a driver's license is fake?

AAMVA defines three inspection levels. A desk can run the first two. Level 1 needs no tools: features you can see or feel. Level 2 needs an instrument, such as UV light, a magnifying glass or a scanner. Level 3 is forensic. The standard requires at least one such feature and leaves its details to experts. Picture an analyst in Ohio holding a Nevada license (illustrative): the check runs against the Nevada designs in circulation, not Ohio's. A REAL ID star shows the card was issued under federal minimum security standards, enforced since 7 May 2025. It does not show that this card came from the state.

How do you check if a passport is real or fake?

Read the machine readable zone (MRZ) at the foot of the data page and recompute its check digits. ICAO says check digits let readers "verify that data in the MRZ is correctly interpreted", a test of the reading, whether by eye or by optical character recognition. The formula is published. A forger prints correct digits as easily as an issuer, so the data page still goes against the issuing state's specimen, and the photo against the person. The Home Office page for its guide opens on the scale: "There are thousands of fraudulent identity documents in circulation."

Is an EU ID card without an MRZ still valid?

No. Under Article 5(2)(a) of Regulation (EU) 2025/1208, identity cards below the minimum security standards in part 2 of ICAO Doc 9303, or without a functional MRZ, ceased to be valid at expiry or on 3 August 2026, whichever came first. Cards that pass those two tests but predate the new format lapse at expiry or on 3 August 2031, whichever is earlier; holders aged 70 or over on 2 August 2021 keep theirs to expiry. Denmark is not bound by the regulation.

Cards in the new format carry a chip with the facial image and two fingerprints (Article 3(5)). A firm can read the chip's signed data through electronic identity verification instead of trusting the printed card, while recital 22 keeps fingerprint checks for authorized staff of national authorities and Union agencies. From 10 July 2027, Article 22(6) of the EU AML Regulation accepts an identity document, passport or equivalent, with information from reliable and independent sources where relevant, or eID means at the substantial or high assurance level with the relevant qualified trust services.

Can a mobile driver's license be fake?

A picture of one can. On 8 September 2026, FinCEN and the staffs of four federal regulators said a bank may accept an unexpired, government issued mDL as one of its documentary methods under the Customer Identification Program (CIP) Rule. The mDL must still show nationality or residence and carry a photograph or similar safeguard, the bank needs the technology to extract its data, and its CIP must allow it. A genuine mDL is digitally signed by the issuing source and bound to a device, so the check is that signature; a screenshot carries none. Where an mDL shows "indications of fraud", the bank "must consider that factor" in judging whether it knows the customer's true identity.

Can a fake ID scan, and what does an ID scanner prove?

Yes, many fake IDs scan. Every card built to the AAMVA standard must carry a PDF417 barcode in Zone V, and a scanner reads whatever is encoded there. Anyone who can print a card can encode a barcode. A clean scan proves that the data is readable and well formed, and nothing about whether a licensing authority issued the card.

The useful test compares the barcode with the printed face. Even there, AAMVA notes that "at times the information is not identical", because a field may sit in the barcode as a coded value to fit the space. So a mismatch goes to review. Declining every mismatch automatically turns away real customers along with the forgers.

The Massachusetts cards show where a scan stops. Had they carried barcodes built from the real customers' details, those would have matched the bank's records, and the photo matched the face at the counter because it was the imposter's own. What remained to test was the card itself, against its issuer's standard.

ID scanners sold to businesses for age checks read a birth date and an expiry date; they say nothing about who holds the card. Holograms and other features that change as the card tilts sit outside the barcode, so a barcode reader never tests them.

What changes when the ID arrives by upload, in a branch or on video?

The Massachusetts scheme also relied on bank insiders who helped, "including by intentionally skipping customer verification protocols". Each channel hides different features. A branch adds the insider.

By upload

A photo or scan flattens the card. Level 2 features need UV light or magnification on the physical card, so they do not survive an upload, and the tactile Level 1 features go with them: texture, relief, laminate edges. The image may also be generated, a picture of a card that was never printed. eKYC checks therefore lean on software. It reads the template, the MRZ and the barcode in the image and looks for signs of editing. Face and liveness checks tie the image to a live person. Ask for the back of the card as well as the front, since the barcode or MRZ is where data and print can be compared.

In a branch

A branch can run both desk levels: Level 1 by eye and touch, Level 2 with a UV lamp and a magnifier at the counter. Insider risk needs a control in the process. A second person signs off any account opened on an ID that failed a check and was accepted anyway, and the record names both.

On a video call

Video sits between the two. Ask the customer to tilt the card slowly toward the camera so a hologram or another changing feature moves. Then ask for the back, held close enough to read the MRZ or barcode on screen, and compare those characters with the front. No one can shine UV light through a webcam. Level 3 stays with forensic experts. A pass on video covers what the camera showed: the moving features and the characters read on screen.

What should the analyst do when an ID looks fake?

Five steps, in this order:

1. Decline, or ask for a second document. The CIP Rule requires a reasonable belief that the bank knows the customer's true identity, and a doubtful ID cannot carry that belief on its own.
2. Record what failed and how it was seen. Name the feature, the inspection level and the channel: "UV feature missing, Level 2, branch" differs from "barcode and print differ, upload". The reviewer and any filing rely on what was observed.
3. Report through the MLRO or BSA officer. The compliance function decides whether to file, and the FTC Red Flags Rule examples name identification documents that "appear to have been altered or forged" among the suspicious documents a red flags program watches for.
4. Never tell the applicant that a report is made. A request for another document reveals nothing; disclosing a report breaks the tipping off rules:
   • US: 31 U.S.C. 5318(g)(2) bars a financial institution and its staff from telling anyone involved in the transaction that it was reported.
   • UK: under section 333A of the Proceeds of Crime Act 2002, disclosing a report is an offense where that would likely prejudice an investigation and the person learned of it through work in the regulated sector.
   • EU: Article 39 of Directive (EU) 2015/849 bars telling the customer that information has gone, is going or will go to the FIU; AML Regulation Article 73 takes its place from 10 July 2027.
5. Look for the same device behind other applications. In the Drammeh ring, one supplier equipped the impersonators. complead's device fraud and behavior analysis picks out a single device used for multiple accounts.

What reached ID desks in 2026?

• 3 August 2026. EU identity cards without a functional MRZ, or below ICAO minimum security, ceased to be valid under Article 5(2)(a) of Regulation (EU) 2025/1208.
• 8 September 2026. FinCEN and four federal regulators' staffs published FAQs under which a bank may accept an unexpired mDL that shows nationality or residence and bears a photograph or similar safeguard as government issued identification for the CIP Rule.
• October 2026. AAMVA published its 2026 card design standard, which replaces the 2025 edition; many jurisdictions will keep issuing to the 2025 edition for some time.
• 21 October 2026. The Home Office uploaded a revised edition of its guide to examining identity documents.

Before the week is out:

1. Pull last quarter's ID failures and check that each one carries a recorded SAR decision, filed or not, with the reason.
2. Send every barcode and print mismatch to a person instead of an automatic decline.
3. List the EU identity cards on file that have no functional MRZ, and ask those customers for a valid document at their next refresh.