Document Tampering: Spotting Forged IDs at Onboarding

Most fraudulent onboardings do not use stolen photos or deepfakes. They use a genuine-looking document with a few fields changed: a date of birth nudged forward, a name swapped, an address overwritten. These edits are cheap to produce and, without structured checks, easy to miss. Document authenticity verification is the discipline of deciding whether an identity document is genuine, unaltered, and presented by its rightful holder.

The Three Ways Documents Fail

Fraudulent documents fall into distinct categories, and each needs a different detection method.

• Genuine but altered: a real document where fields have been physically or digitally modified — the most common attack in remote onboarding.
• Counterfeit: a full reproduction that imitates a real template but was never issued by the authority.
• Fraudulently obtained genuine (FOG): a legitimately issued document acquired using false breeder documents. These are the hardest, because the document itself is authentic.

A common fourth case is the borrowed or impersonated document: genuine, unaltered, but belonging to someone else. That failure is caught by matching the holder to the photo, not by inspecting the document.

Layered Authenticity Checks

No single signal is decisive. Robust verification stacks independent checks so that defeating one does not defeat the system.

• Template validation: compare layout, fonts, field positions, and security features against a reference library for that document type, country, and issue year. A driver's licence with fonts that never shipped in that series is a strong flag.
• Font and text consistency: altered fields often use a substitute typeface, inconsistent kerning, or misaligned baselines. Character-level comparison across the same field on a document surfaces edits.
• MRZ and checksum verification: the machine-readable zone encodes key fields with check digits. If the printed name or date of birth disagrees with the MRZ, or the checksum fails, the document was edited or fabricated.
• Security feature detection: holograms, optically variable ink, microprint, and guilloché patterns behave in predictable ways under different capture conditions. Absence or flatness where a feature should be is significant.
• Image forensics: compression artifacts, cloned pixel regions, and inconsistent noise indicate a photo edited in software. A screenshot of a screenshot rarely survives this.
• Cryptographic verification: where a document carries a chip or a digitally signed credential, the signature settles authenticity directly. This is the strongest check available, because it does not rely on inference from pixels.

The MRZ-versus-visual cross-check deserves emphasis: many altered documents change the human-readable field but leave the MRZ untouched, because forgers forget the machine layer encodes the same data.

Capture Quality Is a Precondition

Authenticity checks degrade quickly with poor input. Glare on a laminate hides microprint. A low-resolution capture makes microtext unreadable and font analysis unreliable. Perspective distortion breaks template matching. Before scoring authenticity, systems should assess capture quality and prompt for a retake when resolution, focus, or lighting fall below threshold — a step that also reduces false rejections of honest users.

In a chat-based flow, this can be handled conversationally: the user submits an image, an automated quality gate responds within the same thread, and a retake request is a single message rather than an abandoned web session. The verification decision and the raw capture can then be separated — the authenticity result is retained for the audit trail while the source image is deleted on a configurable schedule, keeping only what obligations require.

Reducing False Rejections

Over-tight thresholds punish legitimate users with worn cards, regional document variants, or older issue years. Calibrate by keeping a current reference library, tracking rejection reasons by document type and country, and routing borderline cases to human review rather than hard-declining them. Track your false rejection rate alongside your fraud catch rate; a program that blocks 4% of genuine customers to stop a fraction of a percent of fraud is not obviously winning. Document authenticity is one control among several — pair it with holder matching and behavioural signals rather than treating any single check as proof.