Document Fraud Detection: How It Works

TL;DR

• Document fraud detection confirms an identity document is genuine, unaltered and consistent with the person presenting it, in seconds and without a human examiner.
• Fraudulent documents fall into three types: forged (a genuine document altered), counterfeit (a template reproduced from scratch) and fraudulently obtained genuine (a real document issued on false information). Each fails a different check, and the third passes every document check.
• The checks run in layers: template and format validation, security-feature inspection, machine-readable-zone and barcode parsing, image forensics, then liveness and injection-attack detection on the capture itself.
• Accuracy has two numbers, false accepts and false rejects, and both depend on the population measured. A vendor quoting one percentage without the other is not describing its product.
• Detection sits at the start of a KYC flow and feeds everything after it: data extraction, face match, screening and the customer risk rating.

What is document detection?

Document detection is the automated analysis of an identity document to confirm it is genuine and unaltered. It checks the document against known templates, validates security features such as holograms and microprint, reads and cross-checks the machine-readable zone, detects digital tampering in the image, and confirms the data matches the customer’s other records.

The term covers what an examiner at a border does with a loupe and a UV lamp, done by software on a phone photo or a chip read. It is one stage of document verification, which also extracts the data and matches the face, and one input to identity verification, which adds screening and risk. This guide is about the detection stage: how a system decides a document is real, what each check can and cannot see, and what it catches at the end.

The three types of document fraud

Every control on this page is aimed at one of three failure modes, and the difference matters because a system tuned for one is blind to the others.

Forged documents

A genuine document that has been altered: a substituted photograph, a changed date of birth, a new name over the old one. Forgeries break the physical and printed security features around the altered area, so they are caught by security-feature analysis, by comparing the visual data to the machine-readable zone, and by image forensics around the edit.

Counterfeit documents

A document reproduced from scratch to imitate an official template. Counterfeits fail template matching against known genuine specimens, print-quality and material checks, and machine-readable-zone validation, because getting every check digit, font and layout rule right is much harder than making something that looks right.

Fraudulently obtained genuine documents

A real document, issued by the real authority, on false information: a passport obtained with a forged birth certificate, or a driving licence issued to a synthetic identity. There is nothing wrong with the document, so it passes every check on this page. It is caught downstream, by cross-referencing the identity against independent records, by biometric uniqueness (the same face under a different name), by address and geolocation consistency, and by behaviour after onboarding. This is the category that costs money, and the one to ask any vendor about.

Template and format validation

The first check classifies the document: which country, which document class, which version. Issuers change designs every few years and keep several versions in circulation, so a system needs a specimen library that covers versions, not just countries. Zyphe’s library holds over 4,000 document versions from 213 countries and territories, published in full in its documentation, because a coverage list you can check before you buy is worth more than a headline count.

Once classified, the document is compared with the specimen: field positions, fonts, character spacing, colour profile, the layout of the photograph and signature areas, and the format rules for the document number and dates. A counterfeit that reproduces the look of a licence rarely reproduces the exact kerning of its issuing printer.

Security feature checks

Genuine documents carry features designed to be hard to reproduce: holograms and other optically variable devices, microprinting, guilloche patterns, ultraviolet-reactive inks, laser-engraved portraits and text on polycarbonate cards, and tactile elements. Software checks what the capture channel can see.

• Visible light. Holograms and optically variable devices change with angle, so a good capture flow asks the user to tilt the document or records short video; microprint and guilloche are checked for resolution and continuity against the specimen.
• Chip read. Biometric passports and many national ID cards carry an NFC chip whose contents are digitally signed by the issuer. Reading the chip and verifying the signature is the strongest document check available, because a counterfeit cannot forge the issuer’s key.
• What a phone cannot see. Ultraviolet and infrared features, and physical substrate tests, need a dedicated reader. A remote check should be honest about which features it did and did not inspect, and rely on the layered checks below for the rest.

MRZ and barcode parsing

The machine-readable zone on passports and ID cards follows ICAO Document 9303: fixed field positions, a defined character set and check digits over the document number, date of birth, expiry date and the composite line. A forged date that was not recomputed against its check digit fails immediately, and the MRZ data is compared field by field with the visual zone, so a substituted name in the printed area disagrees with the name encoded below it.

US and Canadian driving licences carry a PDF417 barcode whose layout follows the AAMVA DL/ID card design standard. Parsing it and comparing it to the printed fields catches most amateur forgeries, and a barcode that decodes to a different name or date of birth than the front of the card is one of the clearest signals in the whole stack.

Image forensics and tamper detection

When the document is only ever seen as an image, the image itself is evidence. Forensic checks look for the traces editing leaves behind: inconsistent fonts or letter spacing in one field, sharp edges or colour discontinuities around the portrait, compression artefacts that differ between regions of the same image, a resampled area with a different noise pattern, and metadata or dimensions that do not match a camera capture. Portrait substitution, the most common forgery, tends to fail on the portrait boundary and on the mismatch between the printed portrait and the ghost image that many documents carry.

Liveness and injection-attack detection

A growing share of document fraud never involves a physical document. Presentation attacks show the camera a screen, a printout or a mask; injection attacks bypass the camera entirely and feed a synthetic or replayed image, or a deepfake video, into the capture stream through a virtual camera, an emulator or a modified client. FinCEN’s alert of November 2024 describes deepfake identity documents being used to open accounts at US financial institutions.

Detection here is about the integrity of the capture channel rather than the content of the image: device and camera attestation, detecting virtual camera drivers and emulators, checking that frames arrive with the timing and sensor noise of a real capture, and active liveness on the face that must accompany the document. Presentation-attack detection has a testing standard, ISO/IEC 30107-3, and independent laboratories such as iBeta test against it; ask any vendor for the level, the laboratory and the date. Deepfake generation changes monthly, so ask how recently the detection models were updated and against what.

Accuracy: false accepts and false rejects

Document detection has two error rates. A false accept passes a fraudulent document; a false reject stops a genuine customer. Every threshold trades one against the other, and both depend on the population: the document mix, the capture devices, the lighting, the share of worn or damaged documents. A vendor quoting “99 percent accuracy” without saying which rate, on which population, is not describing the product.

• Ask for the false-accept rate on a fraud set that includes all three fraud types, and the false-reject rate on genuine documents from your markets.
• Ask for the manual review rate, because a system that routes a fifth of applicants to a human has moved the cost rather than removed it.
• Ask how thresholds are set per document type and risk tier, and whether you can change them.

Where document detection sits in a KYC flow

1. Capture: the user photographs the document or taps it to read the chip, with guidance that improves the image before any check runs.
2. Detection: classification, template and security-feature checks, MRZ and barcode parsing, image forensics, capture-channel integrity. The document is accepted, rejected or routed for review.
3. Extraction: name, date of birth, document number, expiry and address are read from the visual zone, the MRZ and the chip, and reconciled.
4. Face match and liveness: the live face is matched to the document portrait at a set threshold and checked for presentation and injection attacks.
5. Screening and risk: the verified identity is screened against sanctions, PEP and adverse media data and given a risk rating that drives what happens next.
6. Record: what was checked, against which specimen, what the system saw, and the decision, retained as the verification record. Under the US CIP rule, a description of the document relied on is the record, not a copy of it.

What document detection cannot catch, and what does

A fraudulently obtained genuine document passes stages one to three. What catches it is everything the document cannot fake: a face that has already been verified under a different identity (biometric uniqueness), an address document whose name does not match, a device location that contradicts the declared country or sits behind a VPN, a screening hit, and transaction behaviour after the account opens. Detection is necessary and not sufficient; the design question for any vendor is what the other signals are and whether they run in the same flow.

How Zyphe detects document fraud

Zyphe’s KYC software runs the layers above on over 4,000 identity document versions from 213 countries and territories, with chip reading where the document supports it, active liveness with anti-spoof checks against photographs, screens, videos and masks, a face match to the document portrait at a configurable threshold (75 percent by default), and injection-attack detection for imagery fed directly into the capture stream. The detection models run in-house rather than through a third-party biometric vendor and are updated monthly. Fraudulently obtained genuine documents are caught downstream in the same flow: biometric uniqueness, proof of address with name matching, geolocation and VPN mismatch, screening, and transaction monitoring after onboarding.

The document image itself is processed transiently and stored in the customer’s own encrypted vault; Zyphe retains the verification result, the audit log and the cryptographic proof. That gives the compliance record the CIP rule asks for without a central store of ID images for a breach to expose. The full set of onboarding and post-onboarding signals is on the fraud detection software page.

Related resources

• Fraud detection software
• Document verification: how it works, and how to verify an ID without storing it
• Fullz and synthetic identity fraud
• Synthetic identity fraud in 2026: how AI fake IDs are bypassing KYC
• How fraudsters are beating KYC with 20 dollar deepfakes
• Customer Identification Program (CIP)

Cited sources

• NIST SP 800-63A, Digital Identity Guidelines: Identity Proofing and Enrollment
• AAMVA, DL/ID Card Design Standard
• FinCEN, Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (November 2024)
• iBeta, Presentation Attack Detection testing against ISO/IEC 30107-3
• Europol, forgery of documents and means of payment