The REAL ID Act and its Impact on Fraud Risk Management
If you’re a frequent traveler you may be familiar with the REAL ID Act, especially if you live in a state that isn’t compliant. The measure, passed by Congress in 2005 calls for the standardization of all state-issued driver licenses and ID cards.1 It creates a mandate on Federal agencies regarding the type of identification they can accept for official purposes, but states are not required to comply. The intent of the Act is to enhance national security by reducing identification fraud.
Even though participation by states is voluntary, as of January 22, 2018, travelers from states that are not in compliance (or received an extension to comply) with the REAL ID Act will need to show an alternate form of identification, such as a U.S. passport, if they want to board federally regulated commercial aircraft.2 Federal agencies are also prohibited from accepting driver licenses or identification cards from noncompliant states to access Federal facilities, or enter nuclear power plants.
The impact of the REAL ID Act may go beyond identification for official Federal purposes. Noncompliance with the REAL ID Act can offer an inroad for fraudsters to circumvent identity verification solutions.
For enterprises that use photo-capture technology that rely solely on visual verification of a document to authenticate applicants during account opening, noncompliance with the REAL ID Act can help fraudsters slip through undetected.
The REAL ID Act calls for security measures such as state-to-state data sharing (to ensure applicants don’t hold multiple licenses), facial recognition (REAL ID standards call for states to capture a facial image for everyone who applies for an ID or driver’s license, even if the applicant is not approved) and identity verification to help reduce identity fraud.3
Maryland, once seen as a magnet state for fraud, adopted REAL ID standards that resulted in the Maryland Department of Motor Vehicles canceling 8,000 driver license application interviews in one day because the individuals were not residents of the state.4 In another case, facial recognition successfully identified individuals who paid state licensing employees for fraudulent licenses using the real identities of other people. Because these individuals had been issued other identification documents from the state, under REAL ID rules they already had photos in the state’s database.5
Photo-capture solutions allow consumers to take a photo of their driver license (or other form of government-issued ID) to capture and extract the information on the ID and convert it to the application. This can simplify the onboarding process and can provide a positive customer experience.
The drawback of image-based verification is that many fake IDs can pass photo-capture technology checks because they are either from a state not compliant with the REAL ID Act or are produced by fraudsters who have developed a way to conform to all the known templates for the issuing state.
The fake ID industry is booming— entire businesses have been built solely to produce “super fakes,” a term used to denote high-quality fake IDs.6
These advancements in counterfeiting technology make fake IDs more difficult to detect and the criminals that produce them have become experts at replicating every security detail, even down to the holograms used by the issuing state.7 For example, a couple in Pasco County, Florida produced nearly 1,000 fake IDs complete with holograms and magnetic stripes that allegedly worked, meaning the mag stripe contained data that could be read like a real license.8
While the visual elements of a fake ID may appear to be in order, often the identity information on these IDs has either been manipulated or completely manufactured.
Many photo-capture solutions focus on validating the document and look for signs that an ID may be counterfeit, but they stop there. This can create ‘backdoors’ for fraudsters who are skilled at impersonating identities. Therefore, it is equally important to take a data-driven approach to authenticate the identity information associated with the document. This helps assess the validity of the personally identifiable information on the ID and if it has been associated with other identities or fraud in the past.
As the market becomes more saturated with highly sophisticated counterfeit documents that can potentially pass image-capture screens, innovative companies leveraging photo-capture solutions for authentication should consider adopting a comprehensive data-driven strategy that examines both the document and the identity, helping to protect their customer experience – and their business.
To learn more, view our on-demand webinar hosted on Wednesday, January 31 at 10am PST, Securing the Customer Experience: Verify the ID and the Identity.
Aaron Kline is the Vice President of Product Management at ID Analytics
1. Department of Homeland Security, https://www.dhs.gov/real-id (accessed January 18, 2018).
3. Department of Homeland Security Final Rule, https://www.eff.org/files/filenode/realid/real_id_final_rule_part1_2008-01-11.pdf (accessed January 22, 2018).
4. The Heritage Foundation, https://www.heritage.org/defense/report/real-id-compliance-enhancing-security-respecting-liberty-and-reducing-fraud#_ftn23 (accessed January 22, 2018).
6. WPRI.com, http://wpri.com/2015/05/19/providence-venue-takes-steps-to-detect-fake-ids-almost-too-real-to-spot-may15/ (accessed January 10, 2018).
7. The News Gazette, http://www.news-gazette.com/news/local/2014-03-02/better-tech-makes-fake-ids-harder-detect.html (accessed January 10, 2018).
8. ABC Action News, https://www.abcactionnews.com/news/region-pasco/pasco-county-detectives-bust-major-fake-id-ring (accessed January 10, 2018).