Driver's license verification methods: Barcode, DMV, document and data checks compared

A fake US driver's license bought from an AI ID mill for about $15, the price journalists reported when the OnlyFake service was exposed, arrives as a photo-realistic image with one detail most buyers miss: the PDF417 barcode on the back encodes perfectly. Name, date of birth, license number, issue date, all internally consistent, all formatted exactly to the AAMVA standard.

Run that fake through a barcode parser: pass. Run it through template matching: often a pass. Run it through a DMV record check: fail, because the license number does not exist in any state's records.

Same document, three different verdicts. That is the uncomfortable truth about "driver's license verification": it is not one check. It is four different methods that prove four different things, and most teams buying verification cannot say which one they are actually paying for.

At Signzy, we run driver's license checks inside complete onboarding flows for US banks, fintechs, and delivery platforms, and the most common gap we see in evaluations is exactly this: a team believes it bought identity assurance when it bought data extraction.

Here are the four methods, in the order teams usually adopt them, with what each genuinely proves and what defeats it.

Related Solution

Driver's license verification APIDocument OCRIdentity Verification

Method 1: PDF417 barcode verification

US driver's licenses carry a PDF417 barcode on the back, mandated by the AAMVA card design standard (a small number of older legacy cards predate it). Parsing it takes milliseconds and returns clean, structured data: name, address, date of birth, license number, issue and expiry dates.

What it proves: the barcode is well-formed and its data is internally consistent with what is printed on the front.

Genuine strengths. It is the fastest and cheapest method, it eliminates manual typing errors, and for pure data capture (pre-filling a form, speeding up a rental counter) nothing beats it. If your risk is typos rather than fraud, a parse may honestly be all you need.

What defeats it. Encoding a valid PDF417 barcode is trivial. Open-source generators produce AAMVA-compliant barcodes from any data you type in. Fake ID vendors have shipped scannable barcodes for over a decade, and the AI-generated fake ID wave made the surrounding image quality match. A barcode parse on its own is a data-entry tool wearing a security costume.

Method 2: Driver's license document verification and forensics

This is what most people picture as ID verification: the user photographs the license, and models check template match against the state's known design, font consistency, security-feature presence, image tampering artifacts, and whether the barcode data matches the printed text. A selfie with liveness detection is usually layered on so the face on the license matches the person holding it.

What it proves: the artifact in the photo looks like a genuine license, was not visibly manipulated, and the person submitting it resembles the portrait.

Genuine strengths. It works in all 50 states and on international documents, requires no government data access, catches the large population of low-effort fakes and photo swaps, and the selfie layer addresses possession: is the submitter the person on the card? For age-restricted commerce or marketplace trust checks, forensics plus liveness is often the right cost-to-assurance balance.

What defeats it. The method inspects the image, so it inherits the image's limits. Generative models now produce fakes with correct fonts, plausible security-feature renderings, and clean metadata. Forensics vendors respond with better detectors, attackers respond with better generators, and the gap narrows each cycle. The method also inspects only what was submitted: a genuine license that was reported stolen, suspended, or revoked yesterday photographs exactly like a valid one.

Method 3: DMV record verification with AAMVA DLDV

The Driver's License Data Verification (DLDV) service, run through AAMVA, checks submitted license data against the issuing DMV's actual records in real time. It returns match/no-match flags per field: does this license number exist, and do the name, date of birth, and expiry on file match what was submitted?

What it proves: the record is real. The data exists in the issuing state's file and matches.

This is the check the $15 AI fake cannot pass. The image can be perfect and the barcode flawless, but the license number was invented, and no generator can insert it into a state DMV database.

Genuine strengths. It is the only method that verifies against the source of truth, and it is deterministic: match or no match, not a probability score.

What defeats or limits it. Three things, and buyers should know all of them.

That first row matters more than most buyers realize: California alone has roughly 27 million licensed drivers sitting outside the record-check system. Any vendor claiming "all 50 states" is describing extraction coverage, not record-check coverage, and the two claims deserve separate questions in your evaluation.

Method 4: Identity data network verification

The fourth method does not inspect the license at all. It takes the identity data (name, address, date of birth, phone) and correlates it across credit bureau headers, telco records, utility files, and consortium data. Does this identity exist, does it hang together, and has it been seen behaving badly elsewhere?

What it proves: the person is real and their identity footprint is consistent.

Genuine strengths. It catches synthetic identities, which every document-side method misses, because a synthetic identity can come with a physically perfect fake document. It is frictionless (no photo required) and adds risk signal the document cannot carry.

What defeats it. It never touches the license. A data network check tells you "someone named Sarah Mitchell with this date of birth exists in Ohio." It cannot tell you the license in her hand is genuine, unexpired, or hers. Thin-file populations (young adults, recent immigrants) also generate false negatives, which becomes an inclusion problem.

Driver's license verification methods compared

Read the columns vertically and the point makes itself: no single column covers the threat list. Each method's blind spot is another method's core strength.

Which driver's license verification method should you use

Different risk profiles genuinely need different stacks. This is not a "buy everything" argument.

A reader in the car-rental row can reasonably stop at two methods. A sponsor bank cannot. The matrix is the answer to "what should we buy": it depends on which row you live in, not on which vendor shouts loudest.

Why layered driver's license verification is stronger

The mechanical argument for layering is short. Fraud attacks arrive sorted by effort: barcode-only fakes, then image-quality fakes, then AI-generated fakes with perfect barcodes, then stolen genuine identities, then synthetics. Each verification method caps a different tier. A flow that runs parse, forensics, liveness, and a DMV record check forces an attacker to defeat all four at once: produce a perfect image, with a valid barcode, matching a real DMV record, while facing a live camera as someone they are not.

That multiplication is also why the check should not live alone. A passed license is not an onboarded customer: the same applicant still needs SSN verification, watchlist screening, and, for a business, entity checks. Running the driver's license check as one call inside that larger flow, with face match and DMV-aligned record validation behind a single US API integration (the API reference shows the field-level response), is what turns four separate verdicts into one risk decision.

How to evaluate a driver's license verification provider

Before your next vendor conversation, write down which of the four proofs you actually need: well-formed data, genuine artifact, real record, real person. Then ask every vendor two questions. Which of the four methods does your check perform? And for the DMV record check specifically: in which states does it return a real match, and what happens silently in the states where it cannot? The vendors worth shortlisting answer both in one email. The ones who repeat "all 50 states" without splitting extraction from record verification have answered a different question than the one you asked.