1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

What Things do Companies Look for When Determining if ID Documents Are Legitimate?

Discussion in 'BlackHat Lounge' started by Noah Hawryshko, Feb 22, 2017.

Thread Status:
Not open for further replies.
  1. Noah Hawryshko

    Noah Hawryshko Senior Member

    Joined:
    Apr 28, 2016
    Messages:
    869
    Likes Received:
    723
    Gender:
    Male
    Occupation:
    Biotechnology Engineer at Silph. Co, Saffron
    Location:
    Kanto
    Hey BlackHatWorld,

    If, let's say, I wanted to make some fake Facebook or PayPal ID D to verify accounts, what kind of things would I have to make sure I include in them to they're seen as legitimate?

    Basically, to the best of your knowledge, what are all the ways you could think of that you could spot a fake ID document?

    @secondeye , you have the floor here if you feel like replying.

    NOTE: Let's keep discussion of this within the rules and make an effort to keep this solely about fake document detection methods and not about hacking or identity theft.
     
  2. Sherbert Hoover

    Sherbert Hoover Jr. Executive VIP Jr. VIP

    Joined:
    Dec 26, 2010
    Messages:
    997
    Likes Received:
    8,005
    Occupation:
    ORM - Branding - Content
    Location:
    United States
    Home Page:
    [​IMG]
     
    • Thanks Thanks x 11
  3. Capo Dei Capi

    Capo Dei Capi BANNED BANNED

    Joined:
    Oct 23, 2014
    Messages:
    754
    Likes Received:
    1,732
    Using crap quality materials and outdated design is pretty much what they look for. Unless you have access to the database of the jurisdiction that issued that ID there is no way to determine if it is truly real or not.
     
  4. purplewhale

    purplewhale Junior Member

    Joined:
    Jan 9, 2017
    Messages:
    184
    Likes Received:
    70
    Gender:
    Male
    Make sure your passports code at the bottom matches with the info, use a passport code calculator for that.
     
    • Thanks Thanks x 1
  5. ThopHayt

    ThopHayt Jr. VIP Jr. VIP Premium Member

    Joined:
    Jul 25, 2011
    Messages:
    6,355
    Likes Received:
    2,303
    Remind me again why you need fake ID's to make a Facebook page look legit???

    -ThopHayt
     
  6. Capo Dei Capi

    Capo Dei Capi BANNED BANNED

    Joined:
    Oct 23, 2014
    Messages:
    754
    Likes Received:
    1,732
    In some US states they have a 2D barcode that contains information, If the ID is from a state that has one that code to be correct in order for the ID to be considered "real" when a company scans and decodes it.
     
    • Thanks Thanks x 1
  7. Noah Hawryshko

    Noah Hawryshko Senior Member

    Joined:
    Apr 28, 2016
    Messages:
    869
    Likes Received:
    723
    Gender:
    Male
    Occupation:
    Biotechnology Engineer at Silph. Co, Saffron
    Location:
    Kanto
    Here are all the red flags I've got so far:

    1. Relevant match in reverse image search (e.g. same image with different information has the exact same pixels where it hasn't been manually edited).

    2. Non-SVG template.

    3. Bad-looking signature.

    4. Incorrect EXIF data. EXIF data from a conventional phone camera would probably be a plus.

    5. No results come up when person is searched for on Google (that's why you use a common name, because it'll mask the fact that the person doesn't exist).

    6. No relevant "normal" background in photo of ID document (e.g. a standard white background would be more suspicious than one with an obvious wood table pattern).

    7. Lack of blur, even if small.

    8. Inconsistent lighting.

    9. Resolution inconsistent with what a standard camera would take.

    10. Inconsistent internal compression/formatting of photo.

    11. Obvious metadata implying modification (e.g. checking the "maximize compatibility" option in Photoshop).

    12. Inconsistent passport code (thanks @purplewhale ).

    13. HDR could add credibility, but non-HDR won't necessarily decrease credibility.

    14. Fake-looking signature. Signature should look amateur.

    15. Fonts are even 1 point too big or small.

    16. Fonts are anti-ailased in a way that makes them inconsistent with real ID's.

    17. Picture on identification document looks obviously fake.

    18. Other various information incorrect.

    19. 2D barcode inconsistent with issuing state (thanks @Capo Dei Capi ).

    20. Non-existant address (thanks @Jeffersontalks ).
     
    Last edited: Feb 22, 2017
  8. Noah Hawryshko

    Noah Hawryshko Senior Member

    Joined:
    Apr 28, 2016
    Messages:
    869
    Likes Received:
    723
    Gender:
    Male
    Occupation:
    Biotechnology Engineer at Silph. Co, Saffron
    Location:
    Kanto
    There are many legitimate reasons, the first and most important of which is that sometimes Facebook or PayPal will reject your real ID as fake.
     
  9. Capo Dei Capi

    Capo Dei Capi BANNED BANNED

    Joined:
    Oct 23, 2014
    Messages:
    754
    Likes Received:
    1,732
    What about a real place but a fake apartment number?
     
  10. Noah Hawryshko

    Noah Hawryshko Senior Member

    Joined:
    Apr 28, 2016
    Messages:
    869
    Likes Received:
    723
    Gender:
    Male
    Occupation:
    Biotechnology Engineer at Silph. Co, Saffron
    Location:
    Kanto
    EDIT: I Misunderstood @Jeffersontalks

    You can't make claims against service providers without evidence man, that's not cool. If you feel like you were wronged by @secondeye you're free to open up a shit list and supply evidence against the quality of his service here: https://www.blackhatworld.com/forums/the-shit-list.31/

    But yes, non-existant address added to list.
     
    Last edited: Feb 22, 2017
  11. Jeffersontalks

    Jeffersontalks Regular Member

    Joined:
    Aug 16, 2016
    Messages:
    498
    Likes Received:
    215
    Gender:
    Male
    Occupation:
    Professioanl Blackhatters
    Location:
    Planet Earth
    Home Page:
    Sorry I think you have misunderstand. I don't mean that secondeye service is not good. I mean common problem with people registering stealth account and got limited. And then go to secondeye for solution. If the address is none existence, how can one provide documents?
     
  12. purplewhale

    purplewhale Junior Member

    Joined:
    Jan 9, 2017
    Messages:
    184
    Likes Received:
    70
    Gender:
    Male
    With SecondEye you choose your address, he will upload it to the identification assuming the address is real.
     
  13. Jeffersontalks

    Jeffersontalks Regular Member

    Joined:
    Aug 16, 2016
    Messages:
    498
    Likes Received:
    215
    Gender:
    Male
    Occupation:
    Professioanl Blackhatters
    Location:
    Planet Earth
    Home Page:
    Depends upon location. I am not sure about USA but in Europe you can get away with this. However for certain countries in Asia you can't. Example,Singapore,Hong Kong, Malaysia.
     
  14. Noah Hawryshko

    Noah Hawryshko Senior Member

    Joined:
    Apr 28, 2016
    Messages:
    869
    Likes Received:
    723
    Gender:
    Male
    Occupation:
    Biotechnology Engineer at Silph. Co, Saffron
    Location:
    Kanto
    Looks like I misunderstood you, sorry! I understand now. I still know fairly little about Facebook/PayPal ID stuff.
     
    • Thanks Thanks x 1
  15. I know SEO

    I know SEO Marketplace Mod Moderator

    Joined:
    Nov 29, 2012
    Messages:
    15,720
    Likes Received:
    6,093
    This is drifting dangerously close to fraud, thread shut.
     
Thread Status:
Not open for further replies.