How to Detect a Fake or Malformed AAMVA Driver's License Barcode

The PDF417 barcode on the back of a US or Canadian driver's license encodes the cardholder's identity data in the AAMVA DL/ID Card Design Standard format. Counterfeit IDs almost always fail barcode validation — either the barcode is entirely absent, structurally broken, or encodes data that contradicts itself. This guide shows exactly what to check.

Legal scope. This guide covers reading and validating barcodes on credentials you are authorized to verify — for age checks, access control, and KYC flows. It does not cover creating, altering, or reproducing credentials.

Layer 1 — Structural checks (catch ~80% of fakes)

These fail immediately on any cheaply made fake ID.

1.1 The header must start with @

Every AAMVA-compliant barcode payload, when decoded to text, must begin with an @ symbol followed by a newline (0x0A), a record separator (0x1E), a carriage return (0x0D), and then the literal text ANSI:

@ LF RS CR ANSI 636000100002DL00000000... ↑ ↑ ↑ 0A 1E 0D ← ASCII control characters, NOT spaces

Red flag: If the decoded text starts with anything other than @, or if the control characters are missing or wrong, the barcode is not AAMVA-compliant. Many fake IDs use a plain-text barcode that says the person's name — no @, no ANSI header, no structure.

1.2 The IIN must be a known 6-digit jurisdiction code

Immediately after ANSI is the Issuer Identification Number — a 6-digit code that identifies the issuing jurisdiction. Each US state, territory, and Canadian province has exactly one assigned IIN.

| Jurisdiction | IIN | Jurisdiction | IIN | |:-------------|:-------|:-------------|:-------| | Alabama | 636001 | Montana | 636008 | | Alaska | 636009 | Nebraska | 636054 | | Arizona | 636003 | Nevada | 636049 | | Arkansas | 636004 | New Hampshire | 636039 | | California | 636014 | New Jersey | 636036 | | Colorado | 636020 | New Mexico | 636055 | | Connecticut | 636006 | New York | 636044 | | Delaware | 636011 | North Carolina | 636004 | | DC | 636043 | North Dakota | 636034 | | Florida | 636010 | Ohio | 636023 | | Georgia | 636055 | Oklahoma | 636058 | | Hawaii | 636047 | Oregon | 636029 | | Idaho | 636050 | Pennsylvania | 636025 | | Illinois | 636035 | Rhode Island | 636052 | | Indiana | 636037 | South Carolina | 636005 | | Iowa | 636018 | South Dakota | 636042 | | Kansas | 636022 | Tennessee | 636053 | | Kentucky | 636046 | Texas | 636015 | | Louisiana | 636007 | Utah | 636040 | | Maine | 636041 | Vermont | 636045 | | Maryland | 636003 | Virginia | 636000 | | Massachusetts | 636002 | Washington | 636051 | | Michigan | 636032 | West Virginia | 636061 | | Minnesota | 636038 | Wisconsin | 636031 | | Mississippi | 636051 | Wyoming | 636060 | | Missouri | 636030 | Canada (AB) | 604426 | | | | Canada (BC) | 636028 | | | | Canada (ON) | 636012 | | | | Canada (QC) | 604368 |

Red flag: An IIN that does not appear in the AAMVA published table is definitively non-compliant. The full authoritative table is in the AAMVA DL/ID Card Design Standard (D20), available from aamva.org.

1.3 The subfile designator must be DL or ID

After the header comes one or more subfile designators. For a driver's license this must be DL; for a non-driver ID card it must be ID. Each designator is followed by a two-digit offset and a two-digit length field.

Red flag: Any designator other than DL or ID, or missing designators entirely.

1.4 All required data elements must be present

AAMVA specifies which elements are mandatory. A real license will always have all of them; fakes routinely skip inconvenient ones. The core mandatory set (AAMVA v8, the dominant current version) is:

| Code | Field | Code | Field | |:-----|:----------------|:-----|:----------------| | DCS | Family name | DBB | Date of birth | | DAC | First name | DBA | Expiration date | | DAD | Middle name/initial | DBD | Issue date | | DAQ | License number | DBC | Sex (1=M, 2=F, 9=not specified) | | DAG | Street address | DAU | Height | | DAI | City | DAJ | State/province | | DAK | Postal code | DCG | Country | | DAY | Eye color | | |

Red flag: Any mandatory element missing from the payload. In particular, fakes often omit DAU (height), DAY (eye color), DBD (issue date), or DCG (country).

Layer 2 — Semantic checks (date and value validation)

These catch fakes that got the structure right but put in impossible data.

2.1 Date format must match the jurisdiction

• US jurisdictions: dates are MMDDYYYY (e.g., 01151985 = January 15, 1985)
• Canadian jurisdictions: dates are YYYYMMDD (e.g., 19850115)

Red flag: A US-issued ID with dates in YYYYMMDD format, or vice versa. This is one of the most common mistakes on counterfeit cards — the forger used the wrong format.

2.2 Dates must be logically consistent

Parse all three dates (DOB in DBB, issue date in DBD, expiration in DBA) and verify:

• Issue date is in the past. An ID issued in the future is impossible.
• Expiration date is after issue date. Cards are issued before they expire.
• DOB is before issue date. You must be alive to get a license.
• DOB produces a plausible age. Most jurisdictions issue IDs to persons 15–99 years old. A DOB that makes the holder 104 years old is suspicious.
• Expiration is within jurisdiction limits. Standard US DL expirations are 4–8 years from issue. A 20-year expiration is a red flag.

Logical order: DBB < DBD < today ≤ DBA

Red flag: Any date violation. The most common fake-ID date error is setting the DOB to exactly 21 years before today (the person just turned 21 overnight) or setting the expiration year absurdly far in the future.

2.3 State code in DAJ must match the IIN

The DAJ element holds the two-letter state/province abbreviation. It must match the jurisdiction implied by the IIN. A barcode whose IIN is 636015 (Texas) but whose DAJ field says CA (California) is definitely forged.

| If DAJ is... | IIN must be... | |:-------------|:---------------| | CA | 636014 | | TX | 636015 | | FL | 636010 | | NY | 636044 | | IL | 636035 |

Red flag: IIN/state mismatch. Check every card.

2.4 Height (DAU) must be in valid format

The DAU field uses one of two formats depending on jurisdiction:

• Imperial: 062 in or 062IN (height in inches, space, then in or IN)
• Metric: 157 cm or 157CM (height in centimetres)

Valid imperial range: approximately 048 in (4′0″) to 096 in (8′0″).
Valid metric range: approximately 122 cm to 243 cm.

Red flag: Height of 000 in, a value outside the human range, or a field that's just a plain number with no unit suffix. Many fake ID generators omit the unit or use a nonsensical value.

2.5 Eye color (DAY) must be a valid AAMVA code

AAMVA defines the valid eye color codes:

| Code | Color | Code | Color | |:-----|:--------|:-----|:-------| | BLK | Black | GRN | Green | | BLU | Blue | GRY | Gray | | BRO | Brown | HAZ | Hazel | | DIC | Dichromatic | MAR | Maroon | | PNK | Pink | UNK | Unknown | | WHI | White | | |

Red flag: Any value not in this list (e.g., blue, BLUE, brown, or a hex color code).

2.6 Sex code (DBC) must be 1, 2, or 9

• 1 = Male
• 2 = Female
• 9 = Not specified (AAMVA v8+)

Red flag: Any other value.

2.7 License number format must follow jurisdiction patterns

Each state has its own format for the DAQ (license number) field:

| State | Format example | Pattern | |:------|:---------------|:--------| | California | A1234567 | 1 letter + 7 digits | | Texas | 12345678 | 8 digits | | Florida | A123-456-78-910-0 | Letter + digits with dashes | | New York | 123 456 789 | 9 digits (spaces allowed) | | Illinois | A12345678901 | 1 letter + 11 digits | | Michigan | A 123 456 789 012 | 1 letter + 12 digits |

Red flag: A license number whose format does not match the claimed issuing state. Fake ID generators often use a generic numeric string regardless of state.

Layer 3 — AAMVA version checks

3.1 Version numbers must be consistent

The header encodes two version numbers: 1. AAMVA version — the standard version (00–12 as of 2026) 2. Jurisdiction version — the issuing state's sub-version

Both must be numeric. AAMVA version 00 means the card predates the modern standard; version 01–08 covers the vast majority of cards in circulation. Version numbers above the current published standard are impossible on a real card.

Red flag: Non-numeric version fields, or an AAMVA version higher than the current published maximum.

3.2 Truncation flags must be present in v2+

AAMVA versions 2 and above require truncation flags for first name (DDF), middle name (DDG), and last name (DDE). Each flag is T (truncated) or N (not truncated). Older versions don't have these; newer cards always do.

Red flag: A card claiming to be AAMVA v4+ that lacks DDE, DDF, and DDG.

3.3 Version-specific required fields

Some elements only exist in certain AAMVA versions. For example, DCU (name suffix) was added in v4, and DDH (under-18 until date) was added in v5. A card claiming v8 that omits all v5+ fields is suspicious — genuine cards usually include several newer elements.

Layer 4 — Physical barcode quality

Even a structurally valid AAMVA payload fails if the barcode itself doesn't scan cleanly.

4.1 Minimum quiet zone

PDF417 requires a minimum quiet zone (white margin) of 2× the module width on all four sides. Fakes printed without proper margins will scan poorly or fail entirely. Checking the quiet zone with the Scan & Diagnose tool gives you pixel measurements.

4.2 Contrast ratio

AAMVA requires a minimum print contrast signal (PCS) of 70% (ratio between the reflectance of the lightest and darkest elements). Below this threshold, physical scanners in dim conditions — nightclub entrances, outdoor checkpoints — will fail.

4.3 Module width and symbol dimensions

PDF417 symbols on IDs are printed at a specific resolution. Module widths below ~6 mils (0.006″) are too small for most handheld scanners to read reliably. The Diagnose tool reports the estimated module width from uploaded images.

Putting it all together: a validation checklist

Run these in order — each layer filters out more fakes with increasing cost:

☐ 1. Barcode scans at all (no barcode = automatic fail) ☐ 2. Payload starts with @ + control chars + "ANSI " ☐ 3. IIN is in the AAMVA published list ☐ 4. Subfile type is DL or ID ☐ 5. All mandatory elements present (DCS, DAC, DBB, DBA, DAQ, etc.) ☐ 6. All three dates parse and are logically ordered (DBB < DBD ≤ today ≤ DBA) ☐ 7. DAJ state matches IIN jurisdiction ☐ 8. DAU height is a valid value with unit suffix ☐ 9. DAY eye color is a valid AAMVA code ☐ 10. DBC sex is 1, 2, or 9 ☐ 11. DAQ license number matches state format ☐ 12. AAMVA version is numeric and ≤ current standard ☐ 13. Truncation flags present if AAMVA version ≥ 2 ☐ 14. Quiet zone ≥ 2× module width ☐ 15. Contrast ≥ 70%

Any single failure is grounds for rejecting the credential for automated verification.

Using the PDF417 Studio tools

Diagnose tool (browser, free)

The Scan & Diagnose tool handles layers 1–3 automatically when you upload a photo of a barcode. It reports:

• Whether the barcode decodes
• Whether the payload is AAMVA-formatted
• Quiet zone and contrast metrics
• Derived signals (is21Plus, isExpired) with PII redacted

AAMVA parse API (paid API tier)

For production workflows, POST /api/aamva/parse with redactPII: true returns:

json { "compliant": true, "validation": { "errors": [ "DAJ state 'CA' does not match IIN 636015 (Texas)" ], "warnings": [ "DAY eye color 'blue' is not a valid AAMVA code" ] }, "derived": { "ageYears": 22, "is21Plus": true, "isExpired": false } }

A "compliant": false result or any validation errors should trigger manual review.

Common forgery patterns by type

Cheap printed fakes

• No barcode at all, or a decorative barcode that encodes garbage
• Barcode encodes a plain string like the person's name or "VALID" — no AAMVA header
• PDF417 symbol printed too small to scan at real scanner distances

Template-based fakes

• Correct AAMVA header, but DOB set to exactly 21 years ago (rounded to the day)
• IIN doesn't match the state claimed in DAJ
• Height field is 000 in or missing entirely
• Eye color is blue instead of BLU
• Expiration 10+ years in the future

High-quality fakes

• Structurally valid AAMVA format with all mandatory fields
• IIN matches the state — but the wrong IIN for the specific version claimed
• License number format wrong for the jurisdiction
• Issue date is a weekend or holiday (some states don't issue on those days)
• Missing version-appropriate truncation flags

What to do when a barcode fails validation

1. Do not accept the credential for automated age or identity verification.
2. Request a secondary form of ID from the person.
3. Log the failure — the validation error type (missing field, date anomaly, IIN mismatch) and timestamp — for pattern analysis and compliance records.
4. Do not retain the raw barcode payload beyond what is needed for the check — AAMVA data includes PII and is subject to applicable state and federal privacy laws.

See also

• How to Parse an AAMVA Driver's License Barcode — developer deep-dive on the format
• Scan & Diagnose tool — upload a barcode image and get instant validation
• API Docs — POST /api/aamva/parse reference

The AAMVA DL/ID Card Design Standard (D20) is the authoritative specification. IIN assignments and field requirements change between standard versions; always verify against the current published standard from aamva.org when building production verification systems.