Biometric Verification: 326 Fake IDs Scanned Just Fine

Between twenty twenty-one and this past August, Malaysian authorities logged three hundred and twenty-six cases of fake or misused identity cards. And here's what should stop you cold, many of those cards scanned just fine. The reader lit up green. The data came out clean. And the person holding the card still wasn't who they claimed to be.

If you've ever handed over an I

If you've ever handed over an I.D. and watched someone scan it, you've probably assumed that little beep meant "verified." It doesn't. That's the trap almost everyone falls into, believing that a successful scan proves identity. It doesn't prove identity at all. It proves the card can be read. Those are two completely different things. So how does a fake card sail through a scanner and still be a fake? Let me walk you through it.

Malaysia just rolled out a redesigned national I.D. card called MyKad. The old version had twenty-three physical security features. The new one has fifty-three. We're talking holograms, microtext, ultraviolet marks, laser engraving, and a chip with stronger encryption. There's also a special Q.R. code, and this part matters, you can't read it with a regular phone camera. It needs certified enforcement equipment.

Now, that restriction sounds impressive. Only special devices can scan it? Surely that means the scan does something powerful. That's exactly why people get fooled. The exclusivity creates an illusion that the machine is doing deep verification. But scanning only pulls the data out of the code. That's it. The code itself contains nothing about whether the person in front of you is the real owner.

For an investigator, that gap is everything. For the rest of us, it means the next time a card scans successfully at a bank or a checkpoint, that green light is just step one of three.

What are the three steps

So what are the three steps? First, credential reading, can the machine pull the data. Second, credential validation, did the government actually issue this card, unaltered. Third, biometric matching, does the living face standing there match the face on record. Real identity checks run all three in sequence. And if any single step fails, access gets denied.

The Malaysian system can support that third step. It can do a live facial match against the National Registration Department's records. That facial match, not the Q.R. code, is what actually confirms who you are.

The specialists have a clean way to picture this. Think of a Q.R. code like the seal on a package. The seal proves someone sealed it. Breaking it proves the seal was intact. But the seal tells you nothing about what's inside the box, and nothing about whether you're the person the box was addressed to. For that, you have to open it and check separately.

So here's the shift that makes it all click. A Q.R. code isn't proof of identity. It's a container for data. Scanning it answers "can we read this?", never "is this really you?"