Skip to main content
SupportLog in to the hub
AgeShield

Guide

How to spot a fake ID at the door

A practical routine for door staff, built on what state alcohol regulators publish. It covers the checks you can make by hand, the questions that catch a real ID in the wrong hands, plus what a scanner adds and what it cannot do.

Start your 14-day free trial
An AgeShield scan result on a phone reading CHECK FAILED, Authenticity check failed, with the guest's age, date of birth, expiry and ID type

Start with a routine, not a hunch

Every state program that publishes its method leads with the same instruction, and it is not about counterfeits at all. Oregon prints it in capitals: “Establish A Routine & Stick To It”, every time you check an ID. California ABC teaches F-L-A-G, for Feel, Look, Ask and Give back. Oregon's Responsible Vendor Program adds U-CARD, for Unaltered, Current, Age, Readable and Description. Different letters, one idea: the door that checks everyone the same way catches more than the door that checks hard when something feels off.

Two mechanics come before any of it. Oregon says to have the customer take the ID out of the wallet, and to look rather than glance. A card you never hold is a card you never checked.

The trigger is a policy choice, not a fact, and you can see that in the published numbers. Oregon law requires a check on anyone who looks under 26. Responsible beverage service training summarized by the University of Minnesota uses anyone who appears under 30. Pick your venue's number, write it down and apply it above that line without exception.

What a person can catch

These are the failure modes the state material actually describes, in the order a card tends to give itself away. None of them needs equipment.

  • The photo and the description

    California ABC tells staff to look at the shape of the nose, chin, ears and eyes, because those do not change, while hair, makeup and eye color do. Height and weight should be in the right neighborhood. If the photo does not closely match the person, the state's instruction is to not accept the card.

  • The dates, expiration first

    Oregon's routine checks the expiration date before anything else, then the date of birth. Montana teaches staff to ask the guest how old they are and then do the math themselves. An age that does not agree with the date of birth on the card has already answered the question.

  • How it feels

    Hold the card. Oregon's TOUCH step is raised edges around the photo, bumpy surfaces, irregular lamination, cuts, slits or pin holes, peeling lamination or uneven corners and the thickness and quality of the card. California adds rigidity: a fake often has a different weight or thickness.

  • Printing and alignment

    Oregon: compare the consistency of the printing and look for letters and numbers that do not match or line up. Turn the card 90 degrees, which makes crooked characters obvious. Pennsylvania adds the state logo, which on a bad card is partly missing or looks altered.

  • The back of the card

    Turn it over. On a US or Canadian license the back carries a PDF417 barcode that AAMVA's standard requires on cards that follow the standard, unencrypted, holding the name, date of birth, expiration date, address and ZIP. Front and back are supposed to say the same thing.

  • Shape and vintage

    AAMVA makes the vertical format mandatory for US cards issued to someone under 21 and horizontal for 21 and over, with an Under 21 Until field for the date the holder turns 21. A vertical card is not proof of anything now, since a card issued at 19 is still vertical at 22, but it tells you to read the dates.

The last one is worth a line on its own. Fonts, spacing and layout only look wrong next to something right, so keep a current ID checking guide where the door can reach it. Most states publish their own card designs, current and previous, and Washington's licensing department is one example. A Minnesota model ordinance goes further and asks a licensee to keep a guide covering adult and minor cards for every state and Canadian province, going back at least five years.

The problem no card check solves

A real card that belongs to somebody else passes every test above, because there is nothing wrong with it. California ABC is explicit that F-L-A-G exists to spot false or borrowed identification, and the question lists in the Oregon, Pennsylvania and Montana material only make sense if the card in your hand is often genuine.

The research points the same way without settling it. In a study of underage college students who had a fake ID, Martinez and Sher found 45.0% had been given one by a non-relative and 24.2% by a relative, against 36.4% who bought one. Those figures add to more than 100 because some students reported more than one method, and the study does not separate borrowed real cards from manufactured ones. What it does show is that most of these IDs arrive from another person rather than from a purchase, which is exactly the case your door has to handle.

So ask something. These are the questions the state lists name, and the only skill involved is asking them while you are still holding the card.

  • Middle name. Ask for it, then ask them to spell it. Oregon's routine asks for the spelling, not just the name.
  • ZIP code. On the Oregon, Montana and Pennsylvania lists. It is short, it is on the card and it is rarely rehearsed.
  • The address, recited. Not read off the card. Ask them to say it while you are holding it.
  • The month they were born. California's note: if they answer with a number instead of the name of the month, that is a tell.
  • The year they finished high school. Oregon's list. It has to agree with the year of birth on the card.
  • Zodiac sign. Not on any of the state lists below, but common at doors and built into AgeShield, because a borrowed card's holder almost never prepares for it.
  • A second piece of ID. Oregon and Pennsylvania both say it plainly: people carrying a fake rarely carry back-up identification.
  • A signature. Ask them to sign and compare it to the signature on the card. California and Oregon both teach it.

What you are reading is the pause, not the answer. A person reciting their own ZIP code does not stop to think about it. Montana calls this the art of the interview and tells staff to watch the reaction as much as the reply. Keep it conversational, ask on the way in rather than as an accusation, and ask more than one guest so it is not obvious who you doubted.

None of it works if you do not know the right answer yourself. AgeShield builds these in as challenge questions: staff tap the question, ask the guest, then mark whether the answer was right. The app reveals the answer from the ID for the questions it can, and only for the fields your venue has chosen to collect, so a question can never show a detail you decided not to keep. Passed, failed or skipped is saved with the visit.

What a scanner adds, and what it does not

What it adds

  • It reads the PDF417 barcode on the back of US and Canadian driver's licenses and state IDs. AAMVA's card design standard makes that barcode the minimum mandatory machine-readable technology on a card that follows the standard and requires the data in it to be unencrypted.
  • It runs a forgery check on that barcode in every scan mode. In Fast mode a guest can present the front only, and then there is no barcode on that scan to check.
  • In Secure mode it also reads the printed front and checks that the front and the back agree, which is the machine version of turning the card over.
  • It does the age math against your venue's minimum, flags an expired card and checks the guest against your Banned list, at the same speed at 1am as at 7pm.

What it cannot do

  • It cannot tell you the card belongs to the person holding it. Nothing in a barcode knows whose face is in front of you, which is why the questions above are not optional.
  • It does not catch every fake, and we do not claim a number for how many it catches. A flag reports what the check observed and your staff decide what to do. A clean result is not proof that a card is genuine.
  • It has no barcode to work with on a passport or a US green card, because those carry a machine-readable zone rather than an AAMVA barcode. AgeShield reads them, and the age, expiry and Banned list checks still run, but there is no barcode forgery result.
  • It does not replace looking. Texas requires a seller to visually inspect the ID and scan it for off-premises sales, and warns against relying entirely on a guest's appearance or behavior.

The full breakdown of which checks run in which mode is on how AgeShield checks an ID. US military IDs are a separate question with a federal answer: can a bar scan a military ID?

When you are not satisfied

Decline. Every source on this page lands in the same place. California ABC: “You are never required to sell or serve alcohol to anyone.” Pennsylvania's RAMP page on fake IDs: “If you're not convinced, however, do not serve them.” Oregon is blunter still: if you suspect the ID is false, or you just do not believe the person is 21, do not sell or serve to them.

Hand the card back, and keep the reason about you rather than about them. Oregon's worker education teaches statements like “Legally, I'm not allowed to sell you any products”, which refuses the sale without accusing anyone of anything. Do not tell a guest their ID is fake, and do not accuse anyone of a crime at your door. AgeShield's Terms ask venues not to tell a guest an ID is fake on the strength of a scan result, for the same reason: the result describes what the check saw, and the check can be wrong.

Whether you may keep the card, and whether you should call the police, is governed by your state's law and your venue's policy. AgeShield does not advise on either, and this page is not the place to get the answer. The rules are specific and they differ: California tells a licensee who does seize a card to issue the person a receipt and to turn the card over to the local police or sheriff within 24 hours, while Pennsylvania's guidance says only that if you are not convinced, do not serve. Ask your own attorney which applies to you, decide it once and put the answer in writing before a doorman has to invent one.

A word on the safest default: refusing entry or a sale is something you can do at any door, on any night, without a decision from anyone. Keeping somebody's property is not.

Train your team

A routine that lives in one manager's head is not a routine. Write the door policy down, keep it to a page and go through it on a new hire's first shift rather than their fifth. Eight things belong in it:

  • The age a guest has to look before you card them, and that it applies to everyone above it without exception.
  • The routine itself, in order, in words a new hire can repeat on their second shift.
  • Which documents you accept and which you do not, including the ones your scanner will not read.
  • Which challenge questions staff are expected to ask, and when.
  • The exact words staff say when they decline, so nobody has to invent them at 1am.
  • Who they call when a guest argues, and when that person comes to the door.
  • What happens to a card you will not accept, decided with your own attorney and written down before it comes up.
  • How the decision gets recorded, and who reads those records afterwards.

Then make the decisions reviewable. AgeShield writes a visit record for every scan: who scanned, when, the document type, the result, the scan mode and what staff decided. If an owner has switched on the ability to admit past a failed check, staff have to pick a reason from a fixed list before they can, and the override goes to the audit log with the staff member and the time. The challenge question outcome is saved beside it. Months later you can show not only that somebody was let in, but what your team checked first.

Owners can also set a minimum scan mode per venue, and staff can choose a stricter mode on their device but not a weaker one. That is how you make Secure mode the floor on a Saturday without relying on anyone remembering to switch it.

Questions about checking IDs at the door

What is the fastest way to spot a fake ID at the door?

Have one routine and run it on every guest the same way. The state programs all teach a version of the same thing: take the card out of the wallet and into your hand, check the expiration date, then the date of birth, then the photo against the face, feel the card for cuts, bumps and uneven lamination, then turn it over. California calls it F-L-A-G, for Feel, Look, Ask and Give back. Oregon calls it TOUCH, LOOK, ASK. Speed comes from repetition, not from shortcuts.

What should I do if the photo does not look like the person?

California ABC tells staff to compare the shape of the nose, chin, ears and eyes rather than hair, makeup or eye color, because the first set does not change and the second does. If the photo does not closely match, the published instruction is to not accept the card. You are allowed to ask a question or two first, and you are never required to serve anyone.

What questions catch someone using a real ID that is not theirs?

The short ones that a real owner answers without thinking: the middle name and its spelling, the ZIP code, the street address recited rather than read, the month of birth said as a word, the year they finished high school and a second piece of ID. What you are reading is the pause more than the answer. AgeShield has these built in as challenge questions, and the app shows staff the answer from the ID for the ones it can.

Can an ID scanner tell me an ID is fake?

No. AgeShield reads the barcode on US and Canadian driver's licenses and state IDs and runs a forgery check on it in every scan mode, and in Secure mode it also reads the printed front and checks that the front and back agree. A result reports what the check observed. It is not proof that a card is counterfeit, a clean result is not proof that a card is genuine and no scanner catches every fake. Your staff make the call.

Can I take a fake ID off a guest?

That is a question of your state's law and your own venue policy, and AgeShield does not advise on it. The rules are specific and they differ. California, for example, tells a licensee who does seize a card to issue the person a receipt and to turn the card over to the local police or sheriff within 24 hours. Pennsylvania's guidance says only that if you are not convinced, do not serve. Get your answer from your own attorney and write it into your door policy before the question comes up at a door.

Does a passport or a green card get the same check?

Not the barcode part. The forgery check needs the AAMVA barcode that US and Canadian licenses and state IDs carry, and passports and US green cards do not have one, so they get no barcode forgery result. AgeShield reads them from the machine-readable zone instead, and the age, expiry and Banned list checks still run.

How old does someone have to look before we card them?

The published thresholds differ, which tells you it is a policy choice rather than a fact. Oregon law requires a check on anyone who looks under 26. Responsible beverage service training summarized by the University of Minnesota uses anyone who appears under 30. Pick a number for your venue, write it down and apply it above that line without exception, because a rule staff apply selectively is the one that fails on a busy night.

Sources

Read on 2026-09-16. This page describes what published state training material tells door staff to do. It is general information and not legal advice. Which documents you may accept, whether you may keep a card you will not accept and when police are involved are questions of state law and venue policy, and AgeShield has no view on the answer for your venue. Ask your own attorney.

Give your door one routine and a record of it

Challenge questions built into the scan, a visit record for every decision and 3 devices on every plan. The trial runs 14 days with Pro features.

Start your 14-day free trial