Skip to content
If 2026 proved anything, it’s that identity verification no longer lives in one place. It happens at the door, the dock, the app, the counter, and increasingly inside the phone itself. Fraudsters spent the year working every one of those seams, from fictitious freight pickups to AI-assisted synthetic identities.
At IDScan.net, we see those shifts first in the data: more than 18 million ID and identity transactions a month across 7,500+ customers. Here are seven changes we expect to define identity verification in 2027, and what each one means for businesses that check IDs.
1. Age checks move into the operating system, and the gaps move with them
On January 1, 2027, California’s Digital Age Assurance Act takes effect. It requires operating system providers to collect a user’s age at account setup and pass an age-band signal to app developers. Once developers receive that signal, they’re treated as having actual knowledge of a user’s age range. Existing accounts get until July 1, 2027, so for much of the year apps will see a mix of age-banded and unbanded users.
We expect other states to copy the model, and we expect it to create a false sense of security. An OS age signal is self-declared at setup. It’s a useful first filter for social apps, but it isn’t proof of age for a sports betting account, an online alcohol order, or a vape delivery.
What it means for you: Treat device age signals as a triage layer, not a compliance answer. For anything regulated, plan to step up to document-based verification when the signal is missing, conflicts with other data, or the stakes are high.
2. Mobile IDs stop being a novelty at the counter
As of November 2026, 16 states plus Puerto Rico support driver’s licenses in Apple Wallet, with Virginia and Oklahoma added in the last few months. Utah, Kentucky, and North Carolina are next to launch, and North Carolina has committed to Apple Wallet support by early 2027. Add Google and Samsung wallets and state apps, and mDLs are reaching the point where customers expect them to work in any situation a physical identity document would.
Today, most mDL acceptance happens at TSA checkpoints. In 2027, we expect the pressure to shift to bars, dispensaries, car rental desks, and banks, where staff will face customers who left their physical card at home. The risk is that businesses “accept” a mobile ID by glancing at a screen, which is easier to fake than a plastic card.
What it means for you: A screenshot isn’t an mDL. Real mDL acceptance means reading the credential over NFC or QR and verifying its cryptographic signature against the issuer. If your ID scanning workflow can’t do that yet, put it on the 2027 roadmap now.
3. Checking with the issuer becomes the default, not the upgrade
The strongest answer to “is this ID real?” isn’t what the card looks like. It’s whether the issuing jurisdiction says the record matches. IDScan.net’s DMV API already returns jurisdictional confirmation from 44 states and counting.
As AI-generated document images get better, we expect issuer-backed checks to move from “premium option for banks” to standard practice wherever the cost of being wrong is high: car rentals, freight pickups, account opening, and high-value retail. mDLs push in the same direction, since the credential itself carries the issuer’s verification.
What it means for you: Map which of your transactions are high-risk enough to justify an authoritative data check, and make it automatic there instead of a manual escalation. ID authentication catches most fakes; issuer confirmation catches the ones built to fool inspection.
4. The state-by-state patchwork keeps growing
There won’t be one federal rule for ID checks in 2027. There will be more state rules, each a little different. 2026 alone brought Utah’s “100% ID” alcohol law, New York’s kratom age verification law, and adult-content age verification laws in roughly half the states. Credentials are changing too: Florida’s new license design can carry “Temporary Non-Domiciled” markings on CDLs.
We expect the next wave to target newer age-restricted categories, such as hemp-derived THC, nicotine pouches, and kratom-style products, and to keep tightening rules around commercial drivers. Multi-state retailers and carriers will feel it most.
What it means for you: Compliance is now a moving target that varies by location. Look for verification tools that update rules and document templates centrally, so a new law or ID design doesn’t mean retraining every store.
5. Hiring becomes an identity verification problem
Fake job candidates went mainstream in 2026. In Checkr’s 2026 survey of 3,000 US managers, 40% said they had interviewed a candidate later revealed to be using a fake identity, up from 31% a year earlier. HYPR found that 42% of fraudulent candidates passed pre-hire screening and started the job. In October, the FBI warned that North Korean IT worker schemes increasingly pay US-based stand-ins to show up on camera and pass identity checks for them.
That last shift matters. A deepfake may glitch when the person turns their head; a paid stand-in won’t. Spotting fakes on video is a losing game, which is why we expect 2027 to be the year HR adopts the same document-plus-face remote verification banks use at account opening, and repeats it at more than one stage.
What it means for you: Verify a government ID and match it to a live face before the offer, then confirm it’s the same person on day one, ideally in person when equipment is handed over. A one-time check at the offer letter is exactly what stand-in schemes are built to beat.
6. Digital signatures in physical documents
The barcode on the back of a US license has always been its weak spot. It’s plain data, so anyone with the correct template and a printer can generate one that scans clean. That’s starting to change. California’s October 2025 redesign added a digital security signature to one of the barcodes on the back of the card, one of the first states to do so. In April 2026, AAMVA asked its members for feedback on an update to its Card Design Standard that would standardize cryptographic signatures in the PDF417 barcode for any jurisdiction that wants one.
We expect that standard to land and more states to adopt signed barcodes as they refresh their designs. The result brings plastic cards closer to mDLs: a scanner can check that the data was issued by the state and hasn’t been altered, instead of only checking that it’s formatted correctly.
What it means for you: Signed barcodes only help if your scanner validates the signature. Older software may read a signed barcode as an error and reject a perfectly valid new ID, an issue we covered when California’s new format launched. Ask your vendor now whether signature validation is supported and how quickly new jurisdictions get added.
7. Know Your Beneficiary
Pandemic-era unemployment fraud showed how easily stolen and synthetic identities can drain public programs. The same playbook has since moved into other benefits. In congressional testimony, researcher David Maimon described fraud spreading beyond pandemic assistance into SNAP, Medicare, and Medicaid. Agencies are responding: in October 2026, USDA authorized identity fraud detection technology for SNAP, and Alabama made Login.gov, with photo ID and selfie checks in some flows, the primary identity check for new unemployment claims.
We expect 2027 to bring more states requiring identity proofing before benefits are approved, not just fraud investigations after payments go out. The hard part will be balance. Benefits programs serve people who may not have a smartphone, a current license, or reliable internet, so verification has to be strong without locking out eligible applicants.
What it means for you: For agencies and the vendors who serve them, the winning approach offers more than one verification path: remote document and selfie checks for people who can use them, and in-person ID scanning at offices or partner locations for people who can’t. Both paths should check the same identity against the same authoritative data, so fraudsters can’t simply pick the weaker one.
Getting ready for 2027
The common thread across all seven predictions is that no single check is enough anymore. Age signals, mobile IDs, document authentication, face matching, and issuer data each answer a different question, and fraudsters look for the one you skipped.
Three steps to take before January:
- Audit where you verify identity today, in person and online, and note which checks each touchpoint uses.
- Confirm your tools can read mobile IDs and the newest state license designs.
- Identify your highest-risk transactions and add an authoritative data check there.
Want to see how VeriScan handles physical IDs, mDLs, and remote verification in one workflow? Book a demo.
