153M driver's license scans sold on dark web traced to ID verification vendor IDScan.net

By: Carter Pape Read Time: 6 Min

An illicit website reportedly spent this week selling driver's license scans—including the infrared and ultraviolet images banks use to detect fake IDs—before going offline.

The service, called Nexus, claimed to offer more than 153 million driver's licenses from individuals in the United States and Canada, along with millions of other identity documents, as cybersecurity journalist Brian Krebs first reported Tuesday.

Krebs traced the images to IDScan.net, a New Orleans-based identity verification company, by searching the service for the licenses of more than a dozen friends and family members. He matched timestamps on the nine licenses he found against their travel and rental records.

American Banker could not independently confirm the reporting, as the Nexus site went offline within hours of Krebs' publication. It was replaced by a message reading, "This service is no longer available," according to an update Krebs appended to his report.

The FBI's New Orleans field office "can confirm that it is looking into the incident" but would not comment further while the investigation is ongoing, a spokesperson told American Banker.

Key Details

• Key insight: The records reportedly for sale paired ordinary scans of a license with its infrared and ultraviolet captures—the images a bank's authentication check reads.
• Supporting data: IDScan.net says it performs more than 21 million verifications per month at more than 20,000 locations.
• Forward look: Five proposed class actions were filed against IDScan.net in federal court in New Orleans within two days of the first report.

IDScan.net and Its Banking Clients

IDScan sells document authentication services to banks and credit unions. Its marketing materials inform customers that it saves an image of every ID it scans.

The company reaches some of its customers through the Jack Henry Fintech Integration Network, a catalog of software that banks and credit unions using Jack Henry's core systems can add without building the connection themselves.

Jack Henry—one of the providers IDScan named as an integration partner—said IDScan had notified it that Jack Henry is not impacted, according to a spokesperson for the core provider. It remains unclear whether the licenses offered on Nexus originated from any banks or credit unions.

Jack Henry disclosed a separate data breach of its own this week, which the company attributed to the extortion group ShinyHunters. That incident appears unrelated. No attacker has been identified in the reported IDScan breach.

Company Response

IDScan has not explicitly confirmed a breach. However, on Thursday, the company added a prompt to its contact page asking visitors "concerned that your information may have been part of a security incident" to submit an inquiry.

The Images Banks Use to Catch Fakes

Driver's licenses carry security features that are invisible under ordinary light and appear only under ultraviolet or infrared. Banks often authenticate a license by checking these features, rather than reading the front of the card.

IDScan sells this verification service. Its identity verification page for banks and credit unions states that the check examines security features "only present under ultraviolet or infrared light."

Krebs' own driver's license record listed in Nexus included six image files, according to his Tuesday report: the front and back of his license in an ordinary scan, in infrared, and in ultraviolet.

Banks are already struggling with AI-generated fake documents. Now, the images that power their authentication checks have reportedly been compromised.

Once those images are copied, "the document carries less evidential weight in any process that relies on it alone," Tim Rawlins, senior adviser and director of security at NCC Group, told American Banker.

"A driver's license was never designed to operate li"