Screen Capture and Print Attacks on ID Documents: How Detection Spots Photos of Screens and Photocopies

Most document fraud discussions focus on forgeries: altered dates, swapped photos, fabricated templates. Recapture attacks are less sophisticated. The fraudster doesn't hold the physical ID at all. They have an image of it, perhaps from a data breach, a phishing kit, or a stolen phone, and they present that image to your camera.

There are two common forms:

• Screen capture (screen replay): the attacker displays the ID on a monitor, tablet, or second phone and photographs that screen.
• Print attack: the attacker prints the ID, often in color and sometimes laminated or trimmed to size, and photographs the printout. A photocopy is a variant of this.

Both attacks can pass naive checks. The text is legible, so OCR succeeds. The MRZ checksums are valid, because the data came from a real document. The template matches, because it is the real template. What's missing is proof that a genuine physical document was in front of the camera.

Why recapture is a separate problem

Forgery detection asks whether the document is genuine. Recapture detection asks whether you are looking at the document itself or at a reproduction of it.

The distinction matters because a recaptured image of a perfectly valid ID will clear every content-based check. If your pipeline only validates data consistency, a stolen ID scan becomes a reusable credential that anyone can present.

The signals that give a screen away

Digital displays leave physical traces when photographed. Detection models are trained to recognize them.

Moiré patterns

A screen is a grid of pixels. A camera sensor is also a grid. When one grid photographs the other, the two interfere and produce wavy, rippling bands called moiré. These patterns rarely appear when a camera photographs a physical card, so they are a strong recapture indicator.

Pixel structure and subpixel color

At close range, or after zooming into a high-resolution capture, the red, green, and blue subpixels of the display can become visible. Printed security inks and card substrates do not have this structure.

Glare, reflections, and screen bezels

Glass screens reflect light differently from laminated cards. Reflections may be broad and uniform, and they sometimes show the room or the person holding the camera. The edges of a phone or monitor, a status bar, or UI elements occasionally appear in the frame as well.

Color and brightness anomalies

Screens emit light, and cards reflect it. A displayed ID often looks unnaturally bright, oversaturated, or shifted in color compared to how the same document type looks under ambient light.

The signals that give a print away

Printed reproductions fail in different ways.

Halftone dots and print artifacts

Consumer printers build images from dot patterns. Under magnification, these halftone dots, banding, or toner texture look nothing like the fine-line printing, microtext, and guilloche patterns of a genuine document.

Missing or flat optical security features

Holograms, color-shifting inks, and other optically variable features change appearance with angle and light. A printout reproduces them as static, flat color. A photocopy may lose them entirely or turn them into grey smudges.

Paper texture and edges

Paper has a different surface texture than polycarbonate or laminated cards. Edges tend to be unevenly cut, corners are square where the real card is rounded, and the "card" may bend or curl in ways a rigid document wouldn't.

Loss of fine detail

Every reproduction step loses information. Microtext blurs, thin lines thicken, and ghost images degrade. When a document type is known to carry fine detail and the capture shows none, that gap is evidence.

Designing a flow that resists recapture

Detection models do most of the work, but your capture flow decides how much evidence they have to work with.

Capture live, don't accept uploads by default

If users can upload any image file from their gallery, you've made screen and print attacks trivial, and you've also allowed images that were never captured by a camera at all. Guided live capture through the device camera removes the easiest path. A hosted flow such as DocuPass handles this capture step for you.

Ask for both sides

Requiring front and back raises the bar. The attacker needs images of both sides, and cross-checks between the visual zone, MRZ, or barcode add consistency requirements.

Request sufficient resolution

Moiré, halftone dots, and microtext loss all appear at fine scales. Heavy compression or downscaling before submission can erase the evidence your authentication checks depend on.

Pair the document with a biometric check

A recaptured ID usually belongs to someone other than the person presenting it. Biometric face match against the document portrait, combined with liveness detection on the selfie, means the attacker would also need to defeat a presentation attack on the face side. That is a much harder combination.

Handling flags in practice

Decide in advance what a recapture flag means for your business.

• Auto-reject when a strong signal is present, for example clear moiré with a visible screen bezel.
• Route to manual review when signals are weak or conflicting, and give reviewers the original full-resolution image.
• Allow a retry with guidance ("place your ID on a flat surface and photograph the physical card"), since some legitimate users will innocently submit a scan or a photo of a photocopy.
• Log the outcome so compliance teams can audit why a decision was made and adjust thresholds over time.

Be careful with retries. Unlimited attempts let an attacker probe your system until an image gets through. Limit attempts per session and per identity.

Where this fits in your stack

Recapture detection is one layer in document authentication. It sits alongside template and anti-forgery checks, MRZ and barcode validation, and biometric matching. Each layer covers a different attack, and together they verify that a genuine document, held by its genuine owner, was physically present during the check.

ID Analyzer's document authentication runs fraud and anti-forgery checks across more than 3,000 document formats from 190+ countries. It can be combined with biometric face match, liveness, and AML/PEP screening in a single verification flow. Teams that need to keep identity data in-house can deploy on-premise with ID Fort.