Document Authentication

The Document Authentication module validates the authenticity of a submitted identity document by running a series of forensic checks against the document image. It determines whether the document is genuine or shows signs of forgery or reproduction, and returns the result as a risk level (low, medium, or high) that reflects how strictly the document was evaluated.

Document authentication V1

Validates the authenticity of the fields extracted from an identity document and returns a low, medium, or high risk level.

Capabilities

The module returns four capabilities: three integer-based check failure counts and one overall authentication result.

The module categorises the individual forensic checks it runs into three severity tiers. For each tier, it counts how many checks failed. These counts explain the severity distribution of failures behind the overall authentication result, which helps you decide whether to reject, escalate to manual review, or accept with conditions.

Number of significant checks failed

The number of high-severity authentication checks that failed. Significant checks test the most critical security features of a document, such as template structure, key security elements, and data consistency between the visual zone and machine-readable zone (MRZ). A failure in a significant check is a strong indicator of a forged, counterfeit, or fundamentally altered document.

Detail	Description
Type	Integer
Range	0–100
Default	0

A value greater than 0 indicates serious authenticity concerns. Even a single significant failure typically warrants rejection or manual forensic review.

Number of moderate checks failed

The number of medium-severity authentication checks that failed. Moderate checks test secondary security features and data consistency elements that contribute to overall document confidence but are less definitive than significant checks. Failures may indicate lower-quality forgeries, minor inconsistencies, or legitimate but unusual document variations.

Detail	Description
Type	Integer
Range	0–100
Default	0

A small number of moderate failures may occur on legitimate documents, particularly older documents, documents from countries with fewer security features, or documents captured under poor imaging conditions. The count should be interpreted alongside the overall authentication result.

Number of insignificant checks failed

The number of low-severity authentication checks that failed. Insignificant checks test minor features that have limited impact on the overall authenticity determination. Failures in these checks are common on legitimate documents and are unlikely to indicate fraud on their own.

Detail	Description
Type	Integer
Range	0–100
Default	0

These failures are typically informational. They may be useful for audit purposes or for organisations with very strict acceptance criteria, but they rarely warrant rejection on their own.

Document authentication result

This capability returns the overall outcome of the document’s authenticity checks. It uses the same risk-level model as V2, where the result code reflects the residual risk level after the document has been evaluated.

The key concept: a document that passes under strict (high-sensitivity) checks carries low residual risk, while a document that passes under relaxed (low-sensitivity) checks carries higher residual risk. The result code names reflect this residual risk, not the sensitivity setting.

Code	Label	Meaning
lowRiskPass	Passed with low risk	The document passed authentication under the strictest checks. Residual fraud risk is low. This is the strongest positive result.
mediumRiskPass	Passed with medium risk	The document passed authentication under a moderate set of checks. Residual fraud risk is moderate.
highRiskPass	Passed with high risk	The document passed authentication under the most relaxed checks. Residual fraud risk is higher. Consider combining this result with additional verification steps.
failed	Failed authentication	The document failed authentication checks entirely. It could not be validated as genuine. Possible causes include: the document does not match any known template, security features are missing or incorrect, data fields are inconsistent, or the document appears to be a reproduction.

Default outcomes

The outcome logic maps directly from the authentication result. Each result code produces a corresponding outcome. Unlike V2, which combines authentication and tamper detection results to determine the outcome, V1 uses only the single authentication result capability.

Outcome	Condition	Description
Low Risk	Authentication result includes lowRiskPass	The document passed under the strictest forensic checks. This is the highest-confidence positive outcome.
Medium Risk	Authentication result includes mediumRiskPass	The document passed under a moderate set of checks. Further review may be warranted depending on the organisation’s risk tolerance.
High Risk	Authentication result includes highRiskPass	The document passed under the most relaxed criteria. Residual risk is elevated. Organisations with strict fraud prevention requirements may want to route this outcome to manual review.
Failed	Authentication result includes failed	The document could not be verified as genuine. This outcome typically routes to rejection or escalation for manual forensic review.
ERROR	Default (no conditions matched)	An unexpected error occurred during processing.

This module does not require its own input payload. It runs off of the document images already captured by the Document Classification module earlier in the journey.

Input payload

The following is a sample payload used to submit data to the Document authentication V1 module for processing.

JSON

{
  "context": {
    "subject": {
      "documents": [],
      "identity": {}
    }
  }
}

Field	Required	Description
PrimaryDocument/classification	Yes	The document type to classify the primary identity document as.

Sample response

The following is a sample response for a successfully authenticated document.

JSON

{
  "response": {
    "advice": {
      "significantChecksFailed": 0,
      "moderateChecksFailed": 0,
      "insignificantChecksFailed": 0,
      "authenticationResult": "lowRiskPass"
    },
    "outcome": "Low Risk"
  }
}

Document Authentication V2

Validates the authenticity of a submitted identity document by running a series of forensic checks against the document image, determining whether the document is genuine or shows signs of forgery, tampering, or reproduction. Results are returned at configurable sensitivity levels.

Capabilities

The module returns two capability categories, both of which use the same set of sensitivity-based result values. Each capability can return one or more result codes.

Understanding sensitivity levels

The module uses a sensitivity model that controls how strictly it evaluates documents. This is an important concept for interpreting results correctly, because the code names and their meanings are related:

• High sensitivity: This applies the strictest checks. Fewer documents pass, but those that do carry the lowest risk. A document that passes at high sensitivity has cleared the most demanding forensic criteria.
• Medium sensitivity This applies a moderate level of checks. It balances fraud detection coverage with acceptance rates.
• Low sensitivity This applies the most relaxed checks. More documents pass, but those that do carry higher residual risk because fewer forensic criteria were evaluated.

The result codes reflect the risk level after passing, not the sensitivity setting itself. A document that passes at high sensitivity is labelled LOW_RISK_PASS because passing strict checks means low residual risk. Also, a document that passes at low sensitivity is labelled HIGH_RISK_PASS because passing relaxed checks leaves higher residual risk.

Code	Label	Sensitivity applied	Meaning
LOW_RISK_PASS	Passed at high sensitivity	High (strictest)	The document passed the most rigorous checks. Residual fraud risk is low.
MEDIUM_RISK_PASS	Passed at medium sensitivity	Medium	The document passed a moderate set of checks. Residual fraud risk is moderate.
HIGH_RISK_PASS	Passed at low sensitivity	Low (most relaxed)	The document passed the least rigorous checks. Residual fraud risk is higher.
FAILED	Caution	N/A	The document failed authentication checks entirely. It may be forged, counterfeit, digitally manipulated, or otherwise not authentic. This result warrants further investigation or rejection.

Document authentication result

Returns the overall outcome of the document’s authenticity checks. It evaluates whether the document matches a known genuine template and whether its structural features, such as layout, fonts, security elements, and data consistency, are consistent with an authentic document of that type.

Code	Description
LOW_RISK_PASS	The document passed authentication at high sensitivity. The document’s layout, security features, and data fields are consistent with a genuine document of this type. This is the strongest positive result.
MEDIUM_RISK_PASS	The document passed authentication at medium sensitivity. The document is likely genuine, but some forensic checks were either inconclusive or not applied at the highest strictness.
HIGH_RISK_PASS	The document passed authentication at low sensitivity. The document met the minimum criteria for acceptance, but residual risk remains because fewer checks were applied. Consider combining this result with additional verification steps.
FAILED	The document failed authentication. The document could not be validated as genuine. Possible causes include: - The document does not match any known template in the reference library - Security features are missing or incorrect - Data fields are inconsistent between zones - The document appears to be a reproduction such as a screen capture or photocopy.

Document tampering result

This capability specifically evaluates whether the document has been altered after issuance. Tampering checks look for signs of post-production modification, such as digitally edited text or photographs, spliced images, pixel-level inconsistencies around data fields, or evidence of photo manipulation software.

Tampering detection is different from the authentication check. A document can authenticate as a genuine type (matching a known template) but still fail the tamper check if its content has been modified, for example, a real passport with an altered name or swapped photograph.

Code	Description
LOW_RISK_PASS	The document passed tamper detection at high sensitivity. No evidence of post-issuance modification was found under the strictest forensic analysis. This is the strongest indicator that the document has not been altered.
MEDIUM_RISK_PASS	The document passed tamper detection at medium sensitivity. No clear evidence of tampering was detected, but some checks were either inconclusive or not applied at the highest strictness.
HIGH_RISK_PASS	The document passed tamper detection at low sensitivity. The document met minimum tamper-free criteria, but fewer forensic checks were applied. Residual risk of undetected tampering remains.
FAILED	The document failed tamper detection. Evidence of post-issuance modification was found. This may include altered text fields, a swapped or digitally edited photograph, inconsistencies in font rendering, pixel-level artefacts around data regions, or signs of image splicing. This result is a strong fraud indicator.

Default outcomes

The module combines the authentication result and the tampering result to produce an overall outcome. These default outcomes can be used directly in evaluation and routing logic within the journey designer.

Outcome	Condition	Description
Low Risk	Authentication and tamper detection both passed at high sensitivity (LOW_RISK_PASS)	The document is assessed as genuine and untampered under the strictest forensic checks. This is the highest-confidence positive outcome. The journey can proceed with confidence.
Medium Risk	Authentication or tamper detection passed at medium sensitivity (MEDIUM_RISK_PASS)	At least one of the two checks returned a medium-sensitivity pass. The document is likely genuine and untampered, but further review may be warranted depending on your risk tolerance.
High Risk	Authentication and tamper detection both passed at low sensitivity (HIGH_RISK_PASS)	Both checks passed, but only under the most relaxed criteria. The document met minimum acceptance thresholds, but residual risk is elevated. If you have strict fraud prevention requirements, you may want to route this outcome to manual review or request additional evidence.
Caution	Authentication and tamper detection both failed (FAILED)	Both checks failed. The document could not be verified as genuine and shows signs of tampering. This outcome typically routes to rejection or escalation for manual forensic review.
ERROR	Default (no conditions matched)	An unexpected error occurred during processing. This fallback outcome typically indicates a system-level issue rather than a problem with the document itself.

This module does not require its own input payload. It runs off of the document images already captured by the Document Classification module earlier in the journey.

Input payload

The following is a sample payload used to submit data to the Document Authentication V2 module for processing.

JSON

{
  "context": {
    "subject": {
      "documents": [],
      "identity": {}
    }
  }
}

Field	Required	Description
PrimaryDocument/classification	Yes	The document type to classify the primary identity document as.
PrimaryDocument/extraction	Yes	The data extracted from the primary identity document.

Sample response

The following is a sample response returned by the module.

JSON

{
  "response": {
    "advice": {
      "authenticationResult": [
        "FAILED"
      ],
      "tamperResult": [
        "HIGH_RISK_PASS",
        "MEDIUM_RISK_PASS",
        "LOW_RISK_PASS"
      ]
    },
    "outcome": "Medium Risk"
  }
}

Related guides and tutorials

The following guides and tutorials use this module or explain how to configure it.

How to group document modules

Best practice for grouping documents.