What is an identity document?

An identity document is an official document, usually issued by a government, that records who you are. It typically carries your full name, your date of birth, a photograph and an identifier such as a document number. A passport, a driver licence and a birth certificate are all identity documents.

The key idea is that the document stands in for a claim: an issuer has asserted these details, and the physical object or file is the evidence you present. In identity verification, documents have been the raw material for decades — you show one, someone compares it to you, and a decision is made.

An identity document proves that an authority recorded these details at the time of issue. That is genuinely useful evidence. It does not automatically prove three other things people assume it proves:

• That the person presenting the document is the person named on it. A document can be stolen, borrowed or sold — verification has to test the link, not just the paperwork.
• That the details are still current. Addresses change, names change, documents expire. A licence issued years ago records history, not necessarily the present.
• That the document itself is genuine. Physical documents carry defences — holograms, microprint, machine-readable zones — but every one of those defences is defeated by a convincing copy if nobody checks the copy carefully.

Physical documents are designed to be checked in person: a photograph raised to the light, a hologram that moves, a signature you compare. A digital copy — a photo or scan uploaded to a service — carries the data but flattens most of those protections. What remains checkable in a copy is limited: the layout, the typeface, the machine-readable zone's checksums, the barcode data.

This is why document verification systems exist: software that reads the machine-readable data, checks consistency, inspects security features where it can, and flags what does not add up. They are useful, and they are also playing an arms race — see the next section.

Forgery used to be expensive. Producing a convincing counterfeit passport took craft, equipment and risk, which kept fake documents rare. Generative tools changed that economics: a plausible document image can now be produced at effectively no cost and submitted to a thousand services in an afternoon. The same tools can generate a matching portrait, which defeats the oldest check of all — glancing at the photo and nodding.

The honest conclusion is not that documents are worthless, but that inspecting a submitted image is no longer sufficient. Verification has to add things a generated image cannot supply: a live response to an unpredictable challenge, hardware attestation that the capture happened on a genuine device, and ultimately a cryptographic result rather than an image to eyeball. The full argument is in AI-generated fraud and fake IDs.

In a wallet-based system, the document plays one role: it is the starting evidence. You present a document once during setup, it is checked under active liveness challenges, and what you keep afterwards is a verified credential — a cryptographically signed record of what was proved, held in your wallet, not the document scan itself. Services then receive results and proofs, never documents.

The document did its job once. It does not have to travel with you, be re-emailed, or accumulate in every service's storage — which is precisely the accumulation that turns into breach inventory. The structural argument for never building that archive is why centralised identity databases fail.