ID verification system (AI exploration)
How might we leverage AI to strengthen ID verification in UK retail and hospitality settings while protecting privacy and maintaining human oversight?
CONTEXT
Underage access to alcohol, vaping, and smoking remains widespread across the UK, with 18 % of 11-17-year-olds having tried vaping and over a third of 11-year-olds reporting alcohol consumption. Traditional visual checks of IDs are inconsistent and error-prone, while fake and AI-generated IDs are becoming harder to detect.
PROPOSAL
This project imagines an AI-enabled verification ecosystem for corner shops, bars, and nightclubs, designed to instantly detect forged or borrowed IDs, protect vendors from penalties, and safeguard young people from risk.
Role-based personas
Businesses and institutions face regulatory pressure to ensure compliance and struggle to accurately identify fake IDs, especially when unofficial IDs are presented.
By providing them with an automated, AI-driven, reliable ID check, even for high-traffic environments, they can efficiently authenticate all IDs and avoid potential fines and penalties.
Corner shops, nightclubs, and bars,
Online vendors
Security tech providers
Customers with IDs
Technical structure ecosystem
Stores and venues across the UK that sell alcohol and cigarettes would be equipped with an AI-powered product that scans IDs and uses a sensor camera to match the person with the card.
How it works.
In the background, the card will be associated with either an existing individual in the UK, a completely fake/made-up one, or a real one (maybe!). This validated ID can be stored until a relevant 3rd-party process verifies the card against its known active database.
This system can incorporate all existing ID types typically accepted as proof of legal age, as well as the forms of ID used as workarounds. Some vendors might not have an external card reader/scanner/camera setup, and there may be multiple security checks at different levels. The results should be immediate and in real time.
The tech.
The system uses a multi-network AI pipeline to improve the performance and accuracy of verification results.
ID Image Analysis
A CNN inspects holograms, micro-text, and security patterns.
Optical Character Recognition (OCR)
Text fields (name, DOB, number) are extracted and verified against government and partner databases.
Biometric Face Matching
Parallel CNNs compare facial embeddings between the card and a live camera feed, producing a similarity score.
GAN-Based Authenticity Check
A discriminator classifies IDs as real, fake, or uncertain, improving accuracy over time through continuous learning.
Instant Output + Auto-Deletion
Verdicts are generated in real time; images and personal data are erased immediately to ensure GDPR compliance.
GAN development process.
-
Real and fake IDs: diverse ID samples (real and fake) through partnerships with government agencies, DVSA, and publicly available datasets, including Government ID verification data from countries around the world (see Persona). These should cover different types of IDs (passports, driver’s licenses, temporary licences, ID cards, and student IDs) and from various countries (international IDs).
Facial data from publicly available biometric datasets (see CelebA dataset)
Other data sources: UK demographic data from a partnership with banks, including date of birth and names of individuals under 35, for cross-referencing with text captured in ID images.
-
Feature extraction from ID image (card reader input): When an ID is presented for verification, the ID image is processed by the card reader using a CNN that extracts relevant security features (like the hologram, country flag, user signature, and background visual pattern) and other design elements like image dimensions
Text extraction and parsing: Using optical character recognition (CNN), text (e.g., name, date of birth, and ID number) is extracted from the ID image and then cross-referenced with available databases for verification.
Biometric facial features extraction from ID photo (car reader input) and real-time picture (camera capture): If the given ID type contains an ID photo of the individual, the camera also captures a real-time picture of the individual. That picture is normalised and preprocessed to match the conditions and quality of the ID photo (e.g., image dimensions, resolution, brightness, contrast, and angle) to ensure consistent input data and more accurate feature extraction and model processing.
Facial features are extracted from the ID photo and real-time image in parallel networks that leverage a pre-trained biometric facial recognition model (e.g., a CNN, such as FaceNet or DeepFace). Both CNNs share (normalised/comparable) weights to generate face embeddings, which are then used to calculate facial likeness/similarity scores and determine if faces match.
ID image augmentation: If needed, ID images (real and fake) can be duplicated and augmented by adding visual noise and texture to simulate various real-world scenarios and increase dataset diversity (images under different lighting and weather conditions, old cards, scratched, dirty, discoloured, etc.). This can help achieve balanced datasets of fake-to-real samples, ID types, and other key parameters.
We could engage a community of superminds (expert fake ID makers) to submit anonymous fake IDs (fake names and blurred profile pics).
Data labelling: real and fake IDs can be labelled with country, ID type, and other relevant features.
For training the GAN, the processed data will need to be split into small datasets by ID type using an initial ID-type classification model (the user can also manually indicate this in the early stages to teach the model what input to expect for each ID type).
Per ID type classifier, datasets are split into equal batches of training and testing and split again into equal batches to be fed into the Generator and Discriminator networks, respectively.
-
For each ID type, there is a dedicated GAN model with multiple discriminator networks per GAN, each working on several areas of the ID features (as seen in the example of Wav2Lip). Each discriminator can criticise different aspects of the documents (e.g., format, visual texture, and image) and can be trained and enhanced incrementally and separately/in parallel with other critics.
Generator: Train the generator to produce synthetic IDs from existing samples that span different real-world conditions, which can help improve network accuracy and robustness.
Discriminator: For each input received from the testing batch or the synthetic IDs, real vs. fake IDs are classified by recognising unique features, text accuracy, and facial matches.
All features are passed through the discriminator network as input to determine whether the ID is authentic.
The main discriminator outputs the final result (real or fake) based on the integrated features, including ID-specific attributes, face matching score, and text consistency.
The network outputs a verdict: real or fake ID, and “underage” or “legal age” using a local UK age threshold, such as 18 (for alcohol and clubs) or 21 (for specific alcohol sales).
Optimising the model: If the output is wrong, we could experiment with tuning hyperparameters (e.g., learning rate or batch size), or adjust the images (e.g., if underage and legal-age sets are unequal or certain weather conditions are not accounted for). Then, the training can be repeated with this new and improved batch until the output error rate is ethically tolerable in the given context/business (e.g., high-security clearance, high-risk environments such as banking systems).
For the specific use cases of age-restricted product sales and venue access, the rate might be tolerable at 5% (this is an arbitrary number, but generally it’s a low-risk scenario and would still significantly reduce underage access). Human oversight can be used to provide their best judgment and feed back this information to the system in real-time.
Target market (sustainability).
Opportunities for AI processes to enhance human performance, challenges to sustainability and feasibility, and the added responsibility for the ethical use of these technologies in society.
Value proposition.
-
Using multiple databases to increase the accuracy and reliability of the age verification model.
Gathering insights from partners who monitor the market for new and improved fake IDs and capturing user feedback in real-time and over time for any instances of misclassification.
Updating the model regularly to include emerging fake IDs and fix issues raised, such as possible data misclassifications due to bias, outdated fakes, unaccounted-for image quality (worn-out ID), or real IDs that have undergone redesigns with additional or different security features.
-
These include biometric matching (in person), ID verification with multiple feature verifications, and cross-referencing information checks with numerous relevant databases according to ID type and where the ID originates from (if an international driver’s license, for example).
-
The solution processes data about individuals in the UK, which must comply with GDPR to collect, store, analyse, manage, and delete personal data securely and responsibly.
Security audits and resilience to adversarial attacks.
Regular model testing for adversarial attacks
Updating the model to adapt to new sophisticated system breach methods.
Compliance with UK age verification regulations, such as the Children's Code and Online Safety Act 2023 (Ofcom) for online businesses.
-
Information posters and banners are provided to businesses, which they can post in their shops, for example, to reassure businesses and parents that regulations are in place to minimise the sale of age-restricted products and access by underage people. The collaterals are simple and easy to customise on the platform (e.g., easy co-branding by uploading a logo, brand colours and fonts, and typing the shop name) or, for a small fee, can be done for them by the internal marketing team.
-
Different hardware setups can cater to different businesses’ needs and user savviness, making them more accessible and adaptable to context. This also applies to software usage: businesses can use just the card reader interface, the mobile app/desktop portal and the card reader; the solution can be integrated into their existing retailer platforms or automated for online e-commerce platforms.
-
Offering training through instructional step-by-step videos on the platform, community forums, and direct customer support where needed.
Channels, data, talent, AI training and tech costs
-
(A) Selling directly to retailers and venues that sell age-restricted products in person, cold calls in areas with large student density (schools, universities), areas with dense socialising venues, and through online marketing, online brand ambassadors
(B) Partnership buy-in: Partnerships with retail chains, supermarkets, nightclubs, and smaller vendors can increase buy-in and standardisation, increasing the likelihood of this age verification system being adopted across the UK.
(C) Flexible subscription model with Basic, advanced and Premium plans according to the complexity of business requirements (e.g. frequency of scans, types of setup) and contexts of use (e.g. online gambling, corner store, festival venue access). It could also be free of charge for small businesses or on the Basic subscription plan, for example.
-
Real ID data: data held by regulatory bodies (such as GOV.uk) and publicly available data, including Government ID verification data from countries around the world.
Fake ID data: submitted by superminds and designed synthetic IDs, for example.
Facial data: publicly available datasets (like the CelebA dataset) and additional datasets for diverse demographics and UK-specific individuals.
-
Project Manager
Project Leader
Systems Analysts
DevOps/Cloud Engineers
AI Engineers
Data Scientists
System Testers
Cybersecurity specialists
-
(+ 10% contingency costs)
Software design
Tinkering: testing, experimenting
Subject matter experts’ feedback
Image augmentation
AI cancer mitigation
Data security testing
Human oversight
-
(+ 10% contingency costs)
HARDWARE
PCs (new or upgraded)
Sensors and cameras: Developing custom biometric cameras for face recognition/scanning capabilities to match the person in the store with the ID provided and detect if it is the same person.
Card readers: If certain vendors want that or lack a card reader.
Additional memory, CPU
Cloud services: for hosting and processing of data (including GPUs)
Servers (new or upgraded)
Cabling or wireless network
TEAM (incl.)
Hardware and chip engineer
Industrial designer
3rd party manufacturers (like Samsung or Intel)
SOFTWARE
Software licences
Database user licences
Datasets licenses (sourced from different partners in the UK and internationally)
Other licences
General guidelines for addressing ethical and social issues related to the AI design process.
Societal matters (responsibility).