Schneier on Security
A blog covering security and security technology.
« Gary Marx on Surveillance |
| Security, Economics, and Lost Conference Badges »
February 15, 2006
Real Fake ID Cards
Or maybe they're fake real ID cards. This website sells ID cards. They're not ID cards for anything in particular, but they look official. If you need to fool someone who really doesn't know what an ID card is supposed to look like, these are likely to work.
Posted on February 15, 2006 at 1:19 PM
• 45 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
I was recently confronted with the 'chain of trust' when my newly free (newly US naturalized) wife applied for a passport.
Her only US supplied ID was her citizenship certificate (they trade your green card for it). She doesn't drive, but she could get a State ID. Point is it isn't required (yet) and she hasn't bothered. The passport application wants some other photo ID.
But if she could fake a citizenship certificate (which has her photo) why couldn't she fake whatever other documents she needs to get a drivers license? At some point we have to trust some set of 'source' authentication. Adding new things onto the end of the chain doesn't change the fact that we are only as sure of the person's identity as the original authentication. Sure, a single REAL ID is easier to look up in the database, but it's not any more 'real' than whatever led to it.
The Postal clerk finally took her work ID, but there was no 'issue date' on it. Ironically, with the citizenship certificate in the hands of the PO, my wife now has less ID/proof of US status than she has at any time since her original arrival in the US.
The link's server seems to be "slashdotted" or something, it's coming up really slow for me...
The town I live in is about to do a revaluation of all properties in the township. I received a letter today explaining the process. It said a representative from an appraisal company will show up in my house at some time in the next few weeks.
The letter states, "[The] representative will be provided with identification authorized by the Tax Assessor. Please do not allow anyone to enter your home without proper identification."
And how many people here know what various ID cards look like?
I know what the ones that I have look like, but I couldn't tell you what a Washington State Drivers Licence looks like, or a Spanish Equatorial Guinea Passport, or gym membership cards, or employee IDs from most companies...
Some friends and I started a "club" complete with Membership cards so that we could get club discounts at one of the local stores. Nothing illegal, and no membership fees were charged. But we did get benefits from an organisation that existed solely to allow us access to those benefits.
I often buy discounted student tickets for movies and hockey games. It's not as if the folks working the box office know how to spot a fake ID from each of the tens (hundreds?) of thousands of high schools and universities in North America. Or, in my case, a real ID that expired many years ago. They know this and so they don't even bother looking. I could probably just flash one of those fake credit cards that come in your junk mail to make you open the envelope.
The ID cards look far from official. Who uses the font Comic sans on anything these days?!
When I worked at a prometric testing center, one of the things that was a required resource was a booklet that had a page devoted to various drivers licenses, and things to look for, to aid in determining if they were legitimate or not.
Very handy when presented with an out of state ID...also got the candidates shrugging their shoulders when I'd yank it out to compare their ID with the description in the book...
long ago in college, i sent away for an "international student id". the fake birth date i supplied enabled me to buy liquor most everywhere; i think they've ratcheted down on this since then.
@Arthur: Those driver license books were terrible though as most places which used them only keep the current copies around and as states changed their driver license, the older, yet unexpired licenses presented the inspector with a dilema as to whether accept the old license as valid or reject the person because their license format was no longer in the book. Terrible, terrible system...
Lou the troll
@Arthur, states seem to change their driver's licenses quite frequently. How did you deal with a new license that didn't match the booklet?
Aren't many of these sites fradulent?
Tom and Lou,
There are now automated scanners that recognize valid DLs as well as passports. You can set them up to get regular updates to be sure to keep up with the constant changes. They even check for elements that aren't visible under normal light.
It's been my experience that as long as an ID is printed on a pvc card, like most driver's licenses, it will be accepted no matter how bad it looks. The only exception is if there is an obvious flaw like spelling the name of the state wrong. Everyone assumes that cards like those can't be forged because the printers used to make them are impossible to get The old Polaroid DL's with special lamination were inifinately harder to forge.
Massachusetts has (or had - don't know if it changed) terrible ID laws. Bars were held to be responsible for accepting fake IDs. An exemption was granted for Mass Driver's licenses and Liquor IDs. Of course this meant that bars and restaurants just didn't let out-of-state people purchase alcohol. Imagine being out to dinner or going to a club with visitors from Europe who are being told that only Massachusetts residents are allowed to drink in the establishment. Really pissed a lot of people off.
Anonymousy... The place I used to work had a printer that used dye sublimation to print onto a pvc credit card before running it through a smart card writer (the original had a magnetic stripe writer but this one was modified)...
The only real problem that we had was that the room it was kept in would get rather warm and the printer could only be used at close to normal room temperature. Still, they're obviously not too hard to get.
@Zwack, You can buy a machine for $900. See http://www.idsupershop.com/products/-/33
Anybody taking ID cards without embedded smart chips and PINs isn't really checking much. It's just a work factor issue, making folks work a little harder.
I have nothing to do with this or any other card machine company.
I couldn't get through to the site. The question I would have is whether they not only sell you a card for your identity, but sell your identity to others as well?
That's what I meant. There's no problem buying one, it's just that most people think the average person can't get one.
I don't think there's any problem with printable ID cards. ID cards generally contain nothing but some information that concatenated together form a pointer to a database. You could even print the information on paper using your printer at home, it wouldn't make any difference security wise.
Just to add, if that ID card was specifically meant for humans to interpret, then you'd obviously have to design it with security features that would make it possible for human beings to easily check it's authentic and to make it hard to duplicate or forge.
The price is too expensive. It costs less than $1 here, in Jakarta. You can order it in some shopping center with 1 hour delay.
Dunno, did anyone payed attention, but these guys still suffer from Y2K problem :)))
At the top of each page you can see:
Thu 16 February 106
getYear(), even when implemented correctly (year - 1900) is not actually Y2K incompatible; the incompatibility is assuming that it always means the last two digits of the year. If that's what you want, you could just do getYear()%100. Or if you want the four digit year, do getYear()+1900.
Oops, cleared my sig cookie while playing around with JS. Previous comment was me.
You know that, following the 11/9 attacks, Switzerland has passed a law that requires the mobile phone operators to link every prepaid SIM card to an ID card.
A journalist in Geneva (newspaper Geneve Home Informations) was able to get prepaid cards and phones from the three local majors operators (Sunrise, Orange, Swisscom) using a fake ID from Great Britain! with a very exotic sounding name and a photograph of someone of another ethnicity.
The article is not yet online (see www.ghi.ch).
BTW, Great Britain delivers only passports.
Email me if you need a copy of the article.
@ Ari Heikkinen
My spanish ID card has a lot of security features: multicolour graphics, bits that glow under UV light, machine-readable characters ... but who checks for all that? Whenever I want to get money at the bank, or just pay at the grocery store, the guy/girl at the other side of the counter checks the ID's name with the card's , maybe pay attention to the photograph, and little else. I think you could get a photoshop-like program, a color printer, and get yourself a fake ID that would work 99% of the times.
After all, it's the human factor that makes the weakest part of the security chain...
Why do you need ID to buy groceries??
As someone who writes many of the software drivers of the devices that scan the state DLs, I can attest that at the electronic reading level, it's not much more secure than visually looking at the card! The states can't agree on formats, fields, type of encoding..you name it. And anybody can print the cards with the barcodes! If it looks like a DL...and scans with the name, address, etc....(if not, the clerk just blames the card) chances are, it'll be accepted. It's ALL a "house of cards"....
My brother was working the door at a bar in Syracuse while in college, when someone presented a "Washington DL". He looked at it and said "this is fake, I won't let you in". The presenter disagreed, but quickly changed his tune when my brother said "it's not even a good fake; they're supposed to look like this" and pulled out his WA DL. Heh.
The MA Alcoholic Beverage Control Commission (or whatever ABCC expands to) has said that four IDs are considered "good faith" IDs when accepted by a licensee. Others can be accepted, but if fake the licensee's on the hook; with those, the licensee is expected to be able to recognize fakes.
The four types are MA DL, MA Liquor ID, US military ID [which they then specify as "green active duty card", which I think is no longer green; in any case, excluding dependent IDs etc], or passport.
The Economist had a short article some time ago about an entrepreneur in Mogadishu who...acquired...Somali passport stock, stamps, and so on. Do you think a bartender in Worcester knows what a Somali passport looks like anyway?
Er, not really. I do need to show ID if I want to pay with my credit card (I forgot to say that); cash no problemo.
Oregon has the same list of acceptable IDs. OR Drivers Licence/ID Card (similar cards are used for both) US Military ID or Passport. But that's only for proof of age while buying alcohol.
After I moved here (from the UK) but before I got a driver's licence I tried to write a cheque (check) and was asked for ID. I pulled out my passport.
It took two managers to decide how to accept the cheque. My wife showed them her Drivers Licence so that they could check the address matched. Their tills were set up to accept drivers licence numbers and so they didn't know how to enter the passport number.
Even now, when I'm feeling uppity I show my Green card when asked for ID rather than my Drivers Licence.
More ID fun...
I was born in the US, but mostly grew up in Canada. Hence, when I returned to the US as an adult and tried to open a bank account, the only ID I had was a Canadian DL and a US Passport. They wanted two forms, and the Candian DL didn't count. They would have taken my SSN card (ya, THOSE are hard to fake!) but I didn't have one, just the number in my head. Credit card (even Canadian) would have worked, but I didn't have one of those either. (Yes, most Canadians do, I didn't).
Luckily she knew the HR manager at my new job, and solved it with a phone call.
I know what you mean. Once I had lost my driver's license and to get a reprint I had to have my SSN card and a notorized copy of my birth certificate. Notice that it is only a reprint -- all my information right down to my photo is in the Ohio BMV system. To boot, the registrar's assistant is someone I graduated high school with, so she knows who I am.
I go across 2 counties to get my birth certificate (the one I had wasn't notorized). The nice lady asks what I need. I tell her. She proceeds to print out my birth certificate, signs and seals it right in front of me and hands it to me ... without asking for ANY identification whatsoever. "Have a nice day!", she says.
For that matter, how do I reconize a valid FBI, DEA, Ohio State Patrol, Dayton City Police, etc,,, badge?
The only police badge I would somewhat recognize is Los Angeles City - cause I used to watch Dragnet. (although I didnt know what the picture represented until the movie 20 years later).
@The nice lady asks what I need. I tell her. She proceeds to print out my birth certificate, signs and seals it right in front of me and hands it to me ... without asking for ANY identification whatsoever. "Have a nice day!", she says.@
I went to get a Social Insurance (Canada) number for my daughter because the bank all of a sudden decided it needed one.
I filled out the form for her, as her parent, and went down to the office to turn it in. I didn't have the birth certificate with her correct name on it (they made a mistake on the ones they issued when she was born. I had to pay $27/ea to have them re-issued on thier error, but I digress), but I had her current, valid passport with me.
When I got to the window, the clerk told me that a passport wasn't acceptable ID to get a SIN issued, that the only acceptable documents were an original birth certificate, or a few different immigration papers.
The bar that's set for getting birth certificates in British Columbia is weather or not you have the $27 in cash on you. Getting a passport involves having the birth certificate, and 14 different kinds of jerking around, along with about a metric tonne of paperwork, being that I'm a single dad.
I recently got a student ID card from a fake ID website and so far I havent had any problems with it
This is increasing problems of fake IDs and identity theft which are already a big pain in the head of America, i can't believe this site isn't shut down, what's the point of official IDs anyway if they're being easily simulated?!
In one of my previous jobs (about 15 years ago) I had to travel a lot to the Ukraine by car. The queues on the border were several hours long.
So I printed an official looking ID card on thick paper, glued a photo onto it, stamped with two official looking stamps (I had those made by order in one of the print-shops) and sealed in transparent foil.
On the border I drove straight to the front of the queue and showed the card to the border patrol.
As he didn't see this kind of ID before, he had two choices:
1) Send me back and risk that I call his boss and he's in trouble.
2) Let me jump the queue.
Guess what,I was never sent back to the end of the queue :-).
A few years later I visited the US the first time.
I had an hour long conversation with one of the immigration-officers, and I was asked if I had any other ID on me. When I answered with no, she asked for my purse, and pulled out this ID printed in russian and ukrainian (which I kept with my other documents there just for a laugh) and asked me what it was.
I already saw myself in the prison for being a russian spy :-), but told her the truth - with this paper I am allowed to pass the ukrainian border more quickly.
To this words her eyes started to shine and she told me: "Welcome to the US !", and the interview was over :-)
@Anonymous Bosch: If you look at the "Disclaimer" page, they say the cards are strictly novelty items, and not real ID. Sounds like CYA to me :=)
give us an email wen u find a 99% workin chance on a fake idenity card
Has anyone tried to obtain an id through
I hear that most, if not all websites are fraudulent and you don't get anything after sending the money. Yet I hear in the news all the time about how easy it is to get a fake id.
Hey there, I'm curious if anybody ordered a fake ID from TheIDShop.com? I basically made a cashier's check out to "IDS" and sent it by mail to them almost two weeks ago. The 1-888 phone number on their website doesn't work, and the "supposed" email address this website posts renders NO responses whatsoever. If TheIDShop.com takes a long time to process, I hope to get my card. Otherwise, I'm f_cked because I've been ripped off.
Does anybody here know how long it takes for a fake ID company online to process the money, make the fake ID, and mail it out?
I'm closing comments on this thread because it's become the #2 hit for "Fake ID" on Google, and is now gathering ads from fake ID sellers, not to mention flames from reading-comprehension-challenged people complaining that we don't show any photos of the fake IDs they think we sell.
If you have a legitimate comment, my apologies -- please post it in another thread.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.