What Things do Companies Look for When Determining if ID Documents Are Legitimate?

[Noah Hawryshko]

Hey BlackHatWorld,

If, let's say, I wanted to make some fake Facebook or PayPal ID D to verify accounts, what kind of things would I have to make sure I include in them to they're seen as legitimate?

Basically, to the best of your knowledge, what are all the ways you could think of that you could spot a fake ID document?

@secondeye , you have the floor here if you feel like replying.

NOTE: Let's keep discussion of this within the rules and make an effort to keep this solely about fake document detection methods and not about hacking or identity theft.

 

[Sherb]

 

[Capo Dei Capi]

Using crap quality materials and outdated design is pretty much what they look for. Unless you have access to the database of the jurisdiction that issued that ID there is no way to determine if it is truly real or not.

 

[Deleted member 1034455]

Make sure your passports code at the bottom matches with the info, use a passport code calculator for that.

 

[ThopHayt]

Remind me again why you need fake ID's to make a Facebook page look legit???

-ThopHayt

 

[Capo Dei Capi]

In some US states they have a 2D barcode that contains information, If the ID is from a state that has one that code to be correct in order for the ID to be considered "real" when a company scans and decodes it.

 

[Noah Hawryshko]

Here are all the red flags I've got so far:

1. Relevant match in reverse image search (e.g. same image with different information has the exact same pixels where it hasn't been manually edited).

2. Non-SVG template.

3. Bad-looking signature.

4. Incorrect EXIF data. EXIF data from a conventional phone camera would probably be a plus.

5. No results come up when person is searched for on Google (that's why you use a common name, because it'll mask the fact that the person doesn't exist).

6. No relevant "normal" background in photo of ID document (e.g. a standard white background would be more suspicious than one with an obvious wood table pattern).

7. Lack of blur, even if small.

8. Inconsistent lighting.

9. Resolution inconsistent with what a standard camera would take.

10. Inconsistent internal compression/formatting of photo.

11. Obvious metadata implying modification (e.g. checking the "maximize compatibility" option in Photoshop).

12. Inconsistent passport code (thanks @purplewhale ).

13. HDR could add credibility, but non-HDR won't necessarily decrease credibility.

14. Fake-looking signature. Signature should look amateur.

15. Fonts are even 1 point too big or small.

16. Fonts are anti-ailased in a way that makes them inconsistent with real ID's.

17. Picture on identification document looks obviously fake.

18. Other various information incorrect.

19. 2D barcode inconsistent with issuing state (thanks @Capo Dei Capi ).

20. Non-existant address (thanks @Jeffersontalks ).

 

[Noah Hawryshko]

Remind me again why you need fake ID's to make a Facebook page look legit???

-ThopHayt

There are many legitimate reasons, the first and most important of which is that sometimes Facebook or PayPal will reject your real ID as fake.

 

[Capo Dei Capi]

I think the most obvious will be using a non existence fake address. Saw that on a couple of stealth paypal accounts when dealing with secondeye and had a good laugh out of it. And paypal was happy banning as it was so easy to spot.

What about a real place but a fake apartment number?

 

[Noah Hawryshko]

I think the most obvious will be using a non existence fake address. Saw that on a couple of stealth paypal accounts when dealing with secondeye and had a good laugh out of it. And paypal was happy banning as it was so easy to spot.

EDIT: I Misunderstood @Jeffersontalks

You can't make claims against service providers without evidence man, that's not cool. If you feel like you were wronged by @secondeye you're free to open up a shit list and supply evidence against the quality of his service here: https://www.blackhatworld.com/forums/dispute-resolution.31/

But yes, non-existant address added to list.

 

[Jeffersontalks]

You can't make claims against service providers without evidence man, that's not cool. If you feel like you were wronged by @secondeye you're free to open up a shit list against him here: https://www.blackhatworld.com/forums/dispute-resolution.31/

But yes, non-existant address added to list.

Sorry I think you have misunderstand. I don't mean that secondeye service is not good. I mean common problem with people registering stealth account and got limited. And then go to secondeye for solution. If the address is none existence, how can one provide documents?

 

[Deleted member 1034455]

You can't make claims against service providers without evidence man, that's not cool. If you feel like you were wronged by @secondeye you're free to open up a shit list and supply evidence against the quality of his service here: https://www.blackhatworld.com/forums/dispute-resolution.31/

But yes, non-existant address added to list.

With SecondEye you choose your address, he will upload it to the identification assuming the address is real.

 

[Jeffersontalks]

What about a real place but a fake apartment number?

Depends upon location. I am not sure about USA but in Europe you can get away with this. However for certain countries in Asia you can't. Example,Singapore,Hong Kong, Malaysia.

 

[Noah Hawryshko]

Sorry I think you have misunderstand. I don't mean that secondeye service is not good. I mean common problem with people registering stealth account and got limited. And then go to secondeye for solution. If the address is none existence, how can one provide documents?

With SecondEye you choose your address, he will upload it to the identification assuming the address is real.

Looks like I misunderstood you, sorry! I understand now. I still know fairly little about Facebook/PayPal ID stuff.

 

[iModBot]

This is drifting dangerously close to fraud, thread shut.