Dark web sale of 153M license scans traced to ID verification vendor IDScan.net

By: Carter Pape | 6 Min Read

Overview

• Key insight: The records reportedly for sale paired ordinary scans of a license with its infrared and ultraviolet captures — the images a bank's authentication check reads.
• Supporting data: IDScan.net says it performs more than 21 million verifications per month at more than 20,000 locations.
• Forward look: Five proposed class actions were filed against IDScan.net in federal court in New Orleans within two days of the first report.

Overview bullets generated by AI with editorial review.

Incident Summary

An illicit website reportedly spent this week selling driver's license scans — including the infrared and ultraviolet images banks use to catch fake IDs — before it went offline.

The service, called Nexus, claimed to offer more than 153 million driver's licenses from people in the United States and Canada, along with millions of other identity documents, as cybersecurity journalist Brian Krebs first reported Tuesday.

Krebs traced the images to IDScan.net, a New Orleans-based identity verification company, by searching the service for the licenses of more than a dozen friends and family members, then matching timestamps on the nine he found against their travel and rental records.

American Banker could not confirm the reporting because the Nexus site went offline within hours of Krebs's publication, replaced by a message reading, "This service is no longer available," according to an update Krebs appended to his report.

Investigation Status

The FBI's New Orleans field office "can confirm that it is looking into the incident" and would say no more while the investigation is open, a spokesperson told American Banker.

IDScan has not explicitly confirmed a breach. However, on Thursday, the company added a prompt to its contact page asking visitors "concerned that your information may have been part of a security incident" to submit an inquiry.

IDScan's Business and Partnerships

IDScan sells document authentication to banks and credit unions. Its marketing material tells those customers it will save an image of every ID it scans.

IDScan reaches some of its customers through the Jack Henry Fintech Integration Network, a catalog of software that banks and credit unions running Jack Henry's core systems can add without building the connection themselves.

Jack Henry, one of the providers IDScan named as an integration partner, said IDScan had notified it that Jack Henry is not impacted, according to a spokesperson for the core provider. It is unclear whether the licenses offered on Nexus came from any banks or credit unions.

Jack Henry disclosed a data breach of its own this week, which the company attributed to the extortion group ShinyHunters. That incident appears to be separate. No attacker has been identified in the reported IDScan breach.

The Images Banks Use to Catch Fakes

Driver's licenses carry security features that are invisible under ordinary light and show up only under ultraviolet or infrared. Banks often authenticate a license by checking those features, not by reading the front of the card.

IDScan sells that check; its identity verification page for banks and credit unions states that the check examines security features "only present under ultraviolet or infrared light."

Krebs's own driver's license record listed in Nexus included six image files, according to his Tuesday report: the front and back of his license in an ordinary scan, in infrared, and in ultraviolet.

Industry Implications

Banks are already struggling with AI-generated fake documents. Now, the images that make their authentication checks work have reportedly been compromised.

Once those images are copied, "the document carries less evidential weight in any process that relies on it alone," Tim Rawlins, senior advisor and director of security at NCC Group, told American Banker.