Talk to usTry the demo

Open Datasets for Identity Document Fraud Research

Evaluation and benchmarks

For: Engineer, researcher or product owner who has to read or design an evaluation of identity document analysis and forgery detection

A reader's guide to open identity document datasets: what each contains, which fraud patterns it covers, how it is licensed and what a benchmark result on it can show.

You are about to design an evaluation of document analysis or forgery detection, or you are reading a result that someone obtained on a public dataset, and you need to know what that dataset can actually show. This article reads the papers and repositories behind the widely cited open collections of identity document images and answers one question: which dataset fits which task, and which conclusions does it not support?

The collections discussed are the datasets of the MIDV family, the Document Liveness Challenge dataset, SIDTD, MIDV-Holo, DocXPand-25k, IDNet and FMIDV, the last through the dataset's own page. Everything below is taken from the dataset papers, the licence texts and the project pages, and figures are attributed to the document that states them. None of these datasets is used by the Company as a training set or a test set in anything stated on this page; the article is about reading research evidence.

Why open identity document data is scarce

Identity documents carry personal data, and that single fact shapes every public dataset in the field. The MIDV-500 paper lists five reasons. Storing personal data creates a security risk if it leaks. People are reluctant to share their documents with someone they do not trust. Each document is bound to its owner, which makes real samples rare and raises the cost of collection. Few public samples exist for each document type and most are protected by copyright. In many countries even collecting and storing such data without special permission is illegal.

The MIDV-2020 paper opens with the same observation and adds a consequence for the research itself: the few available datasets lack diversity of document types, capture conditions or field values, and were typically designed for only a subset of document recognition problems. The authors of DocXPand-25k describe the same constraint, privacy restrictions, security requirements and legal reasons, as the reason researchers cannot reproduce and compare results on large public collections. The authors of SIDTD add a second scarcity that matters for fraud work: forged documents are rare compared with genuine ones, and the way they are produced varies from one fraudster to another, which gives the forged class a high internal variability.

The common answer is to build documents that are not real. The datasets in this article use sample or specimen documents from public sources, mock documents printed from edited templates, or fully synthetic images with generated faces and invented personal data. Each choice solves the privacy problem and each leaves a gap, and most of what follows is about those gaps.

Match the dataset to the task

Identity document analysis is not one task. The MIDV-2020 paper lists the sub-problems that a complete system has to solve: robust document detection, type identification, text field recognition, identity fraud prevention, and document authenticity validation, from photos, scans or video frames. The MIDV-2019 paper gives a longer list for mobile capture that includes determining the document class, detecting document boundaries, per-field segmentation and layout analysis, personal photo detection, text recognition, video stream analysis, image quality estimation and the detection of security features such as holograms.

For the purposes of choosing a dataset it helps to group these into four families. The first family is capture and extraction: locating the document, classifying its type, finding the portrait, reading text fields and the machine readable zone. The second is forgery detection on the content of a document: a changed field, a replaced portrait, a pasted region. The third is recapture and copy detection: telling a laminated original from a printed copy or a photograph of a screen. The fourth is verification of optically variable devices, the elements usually called holograms. The datasets below sit mostly in one or two of these families, and the fit is the first thing to check.

The MIDV family

MIDV-500 and MIDV-2019

MIDV-500 consists of 500 video clips for 50 identity document types, with ground truth, and the paper reports baselines for face detection, text line recognition and document field extraction. Its source images are either in the public domain or distributed under public copyright licences, which is how the authors avoided using real personal data. The MIDV-2020 paper describes the construction: ten clips per document type, mostly sample or specimen documents found on a public media repository, shot with two smartphones under five conditions called Table, Keyboard, Hand, Partial and Clutter. The same paper notes what this design left out: variation in lighting and significant projective distortion.

MIDV-2019 was published to close that gap. It contains video of the same 50 printed documents under two added conditions, low lighting and strong projective distortion, recorded with two higher-end smartphones. Each document received four new clips, which makes 200 new clips in total. The 50 document types comprise 17 ID cards, 14 passports, 13 driving licences and 6 other identity documents of different countries.

Both datasets are valuable for capture and extraction research and are of limited use for much else. The MIDV-2020 paper names the main disadvantage directly: all images were made from the same 50 physical document samples, so the text and graphical data are not variable, which makes reliable evaluation harder.

MIDV-2020

MIDV-2020 was built to supply the missing variability. It consists of 1000 video clips, 2000 scanned images and 1000 photos of 1000 unique mock identity documents, each with unique text field values and a unique artificially generated face. The total is 72409 annotated images, and the authors describe it as the largest publicly available identity document dataset with variable artificially generated data at the date of publication.

The construction is worth reading in some detail because it explains what the data can represent. The set covers ten document types with 100 documents of each, and each type is identified by the code of the public document registry used in Europe where one exists. The original sample images were edited to remove signature, photo and text values, and generated values were added in a font that closely resembles the original. Faces came from a service that lists a StyleGAN-based approach, and a mock signature was drawn to resemble the spelling of the last name. Birth, issue and expiry dates were generated with a preset distribution: 80% adult holders aged 18 through 60, 10% seniors and 10% children and adolescents, with an even split between female and male holders. The finished templates were printed to scale on glossy photo paper, laminated and cropped, with rounded corners.

Each physical document was scanned, photographed and filmed. Scans were made in two modes, one upright and one rotated to an arbitrary angle, at a resolution of 2480x3507 pixels. Photos were taken with two smartphones under eight conditions, including low light, a keyboard, a table, cloth and text backgrounds, outdoor light, strong projective distortion and highlights from the sun or a lamp, at a resolution of 2268x4032 pixels. Video was recorded vertically at 2160x3840 pixels and 60 frames per second, and every sixth frame was annotated, which gives 10 annotated frames per second and 68409 annotated video frames. Annotations include the document quadrangle, the face oval and, for template images, the position and exact value of every text field.

The paper provides baselines for document location and identification, text field recognition and face detection. It also states a limit that a reader should keep in mind: although the dataset consists of fake documents, its usefulness for computational document forensics, presentation attack detection and other authenticity validation is limited, and expanding it for fraud prevention work is named as future work. That limit is the reason the extensions in the next sections exist.

Datasets built to test fraud detection

DLC-2021: recapture, photocopy and lamination

DLC-2021, the Document Liveness Challenge dataset, takes the mock documents of MIDV-2020 as originals and films three attack types that remain realistic with mock documents. These are a colour printed copy without lamination, a grey printed copy without lamination, and a displayed image of the document on a screen. The authors describe the dataset as a basis for evaluating document image recapture detection, photocopy detection and lamination detection.

The dataset holds 1424 video clips of the same ten document types as MIDV-2020, with eight physical examples per type. The clip counts by type are 290 laminated originals, 484 unlaminated colour copies, 250 unlaminated grey copies and 400 screen recaptures. Two smartphones, two resolutions and two frame rates were used, and each clip is at least five seconds long, with frames extracted at 10 frames per second and the document position annotated manually for the first 50 frames. The authors chose video because a stream lets an analyst study changes over time, while noting that video frames carry compression artefacts that can affect algorithms.

Two details deserve attention. First, the paper treats all images of the MIDV family as images of genuine documents that can serve as negative samples for document fraud detectors. Second, the baselines are modest and the paper says so: for screen recapture detection the authors trained a ResNet-50 based classifier on patches, and for grey copy detection all the CNN models they tried either did not train at all or overfitted, so only a trivial reference classifier is reported. A dataset can be useful as a challenge precisely because the first baselines fail.

The Zenodo record for the data states that the dataset complies with the GDPR because it contains synthetic IDs with generated owner photos and artificial personal information. It is split into three parts by video type, and the first part, with the laminated originals and the grey copies, is a record of 33.9 GB. The paper states that the data are available under a Creative Commons Attribution-ShareAlike 2.5 Generic licence.

SIDTD: forged fields on MIDV-2020 documents

SIDTD is an extension of MIDV-2020 intended to help train and evaluate forged document detection. The genuine class consists of the original MIDV-2020 material and the forged class consists of altered versions of it. Two techniques create the forged versions. Crop and Replace exchanges a region between two documents of the same type, with a random shift so that the match is never perfect and a texture discontinuity appears at the border that a detector must find. Inpainting removes a text field, rebuilds the background and writes new content in a randomly chosen font. The authors note that, depending on the shift and the font, the result can range from easily distinguishable by a person to extremely subtle.

For video, 191 counterfeit documents were printed on paper, laminated with 100-micron pouches and recorded with a wide range of smartphones, with clips of 4 to 13 seconds, an average of 7 seconds. The result is 1,222 forged templates and 191 videos of forged documents, from which 7,214 frames were extracted, against 68,409 frames from genuine MIDV-2020 documents. The corpus covers ten European nationalities in equal shares.

The technical validation is the most instructive part of the paper. Five models were trained: EfficientNet-B3, ResNet50, ViT-L/16, TransFG and CoAARC. On the template-based task the first reported accuracy is 0.994 for EfficientNet-B3, while ViT-L/16 reaches only 0.552 on the same task. On the video-based task all five models exceed 0.97. When the models are trained on some nationalities and tested on others, the few-shot task, the reported accuracies fall to between 0.530 and 0.635 in the paper version. The authors conclude that detecting alteration is relatively easy when models are trained on enough data from a given set of nationalities, and that the difficulty appears for documents of unknown nationalities.

There are two inconsistencies a careful reader should note. The repository page for the project lists few-shot accuracy of 0.820 for EfficientNet in its results table. The results table of the paper gives 0.593 for the same model and task, so the version of the evaluation matters when numbers are compared. The paper describes the licence as Creative Commons Attribution-ShareAlike 2.5. The repository page shows a CC-BY-4.0 label. Before reuse, read the licence that applies to the actual data record.

FMIDV: copy-move forgeries on MIDV-2020 documents

The page of the University of La Rochelle presents FMIDV as a dataset for copy-move forgeries on the identity documents of the MIDV-2020 dataset. It states that FMIDV consists of 28k forged identity documents for 10 countries, and that for each identity document in the template, photo and scan categories of MIDV-2020, 7 forged samples were generated by a copy-move operation. The copy-move operations were applied on zones of 16 by 16, 32 by 32 and 64 by 64 pixels, selected randomly. The forged part is organised as four sets of 7K identity documents for 10 countries each: forged templates, forged photos, forged rotated scans and forged upright scans. The dataset has a size of 4.7 GB, is hosted on an FTP server of the university, and access is requested by contacting the group by e-mail. The page asks anyone who uses it to cite the 2023 paper "Guilloche Detection for ID Authentication: A Dataset and Baselines". The page says that the forged samples contain many similar but genuine objects, which it describes as a challenge for copy-move forgery detection algorithms. The page's own description therefore points to one manipulation method, copy-move, applied to the template, photo and scan versions of the documents.

MIDV-Holo: holograms in video

MIDV-Holo is described by a later paper as containing 700 video clips. It uses two kinds of document, identity card-like and passport-like, with ten model variants of each, five fictitious identities per variant, and for each identity three original clips and four presentation attack clips. The attacks are a copy without a hologram, a pseudo hologram copy made as a static imitation in an image editor, a photocopy of the document, and a photo replacement in which an original document is physically altered to change the face picture. In the photo replacement attack no hologram is visible over the face, although it remains on the rest of the document.

The paper that studies it proposes a method that checks the presence of hologram content in the face photograph area and reports it as the first method it knows of to address the photo replacement attack. For fair comparison its authors also define training, validation and test splits of 64%, 16% and 20%, with distinct identities in each subset, and they note that MIDV-Holo still contains little data. This is a good example of how a dataset becomes useful only after a community fixes a protocol around it.

Large synthetic collections

DocXPand-25k

DocXPand-25k consists of 24,994 labelled images generated from custom vector templates for nine fictitious designs: four identity cards, two residence permits and three passports. The images contain generated personal information, faces and barcodes and are placed on about 5.8k backgrounds taken from real photos, scans and screenshots of identity documents. The backgrounds come from about 3.2k images with real card-format documents and about 2.6k images with real passports, and the authors state that they reviewed each final image twice to remove any that could leak personal information. The labels cover the document class, the document position, the position of the identity photo, ghost image and barcode, and the position and exact value of every text field, in a total of 237,895 labelled text fields.

The authors position the dataset against MIDV-2020. Their argument is that their generation process can produce an arbitrary number of images per class with little manual effort, and that it increases the variety of backgrounds, devices and conditions. They support the claim of realism with a perceptual similarity measure against a private reference set of 2,719 real identity document images captured by end users on an industrial platform.

The baselines are useful as a calibration of difficulty. Three lightweight networks reach document classification accuracies of 99.65%, 99.80% and 99.16% on a test set of 3,446 images and 15 classes. A corner-based localisation model reaches an average intersection over union of 0.969 and 95.4% of documents localised at the threshold of 0.9. An off-the-shelf text recognition engine, used without fine-tuning, recognises 54.5% of text fields correctly, and fewer than half of the machine readable zones are read perfectly even though the character error rate there is about 2.5%. The authors call this insufficient for industrial use and expect fine-tuning on the dataset to improve it. The reading for a practitioner is that classification of known layouts is easy on this data and field recognition is not.

The labels and the baseline tasks of DocXPand-25k do not include forgery detection. The tasks it supports are classification, localisation, detection of identity-specific features and text field recognition.

IDNet

IDNet was created to fill exactly that gap. Its authors argue that earlier public datasets offer a limited number of samples, cover few fraud patterns and rarely alter critical personal fields such as the portrait. IDNet comprises 837,060 synthetic images, about 490 gigabytes, in 20 document types from 10 US states and 10 European countries. Each type has 5,979 distinct document samples, and for each sample six forged variants are generated, so 41,853 samples exist per type.

The six fraud patterns are crop and move, inpaint and rewrite, text replacement, face morphing, portrait replacement and a mixed pattern. The first two are taken from SIDTD, and the others are described by the authors as not previously implemented in a public dataset. The generation pipeline uses a diffusion model to remove portraits and personal information from publicly available sample documents, generated faces to fill the templates, and a language model to produce metadata for between 9 and 21 text fields.

The paper also contains a compact survey that is useful as a map of the field. It reports the number of distinct documents and fraud patterns as follows: MIDV-500 has 50 documents and no fraud patterns, MIDV-2020 has 1,000 and none, and SIDTD has 2,222 with two patterns. The survey also lists FMIDV, which this article describes from the dataset's own page instead.

The experiments in the paper carry two findings that apply well beyond this dataset. The first concerns privacy-preserving training. Masking the sensitive fields almost disabled fraud detection, because the representations that helped detection were erased together with the personal data, while a differential privacy method at low strength barely changed detection and left the sensitive information recognisable. The authors call the simultaneous protection of sensitive information and retention of detection performance an unsolved problem. The second finding concerns generalisation across document types. A face morphing detector trained on one US driver's licence type dropped from 98.65% to 50.55% accuracy on another, and the reverse direction dropped from 98.1% to 54.1%. Portrait substitution detection was more robust but still fell, for example from 88.95% to 71.20%. The authors conclude that fraud detection models rely heavily on type-specific features such as background patterns and size.

Licences: read them before you plan the work

The licence determines whether a dataset can sit in your pipeline at all. This article does not interpret licences; it reports what the primary texts say and recommends reading the full licence for the data you intend to use.

The DocXPand-25k release notes state that the dataset is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence. The repository page shows the generator code under the MIT licence. The two licences differ in kind. The Creative Commons deed for the first lists the conditions attribution, non-commercial use and share-alike: you must give appropriate credit, you may not use the material for commercial purposes, and if you remix or build upon the material you must distribute your contributions under the same licence. The deed states that it is not a licence and has no legal value, and that it highlights only some of the key terms of the actual licence. The MIT licence text grants permission to use, copy, modify, merge, publish, distribute, sublicense and sell copies of the software, on the condition that the copyright and permission notice is included, and provides the software as is, without warranty.

Other datasets in this article carry other licence statements. The DLC-2021 paper states Creative Commons Attribution-ShareAlike 2.5 Generic for the data. The SIDTD paper and repository page give two different labels, as noted above. MIDV-500 states that its source images are in the public domain or under public copyright licences, which allows use with attribution to the original publisher. MIDV-2020 acknowledges that its source images come from a public media repository with author attributions listed in a table, and that its faces came from a generation service. A model trained on a dataset can inherit obligations from the data, and a team that works commercially should settle the question before the first experiment, with the people who own that decision.

What these datasets cannot tell you

The documents are not real, and the physical gap is the main limit

A 2026 study of generative models and identity documents makes a point that applies to the whole field. It observes that the MIDV family and its derivatives use templates printed with laser printers and laminated, and that purely digital collections such as IDNet abstract away the manufacturing processes of real documents. Real documents combine substrates such as secure paper and polycarbonate with printing methods such as offset, inkjet, dye-sublimation and laser engraving, and each method leaves characteristic textures. The study concludes that this makes the existing datasets well suited to general computer vision tasks but less appropriate for forensic analysis and anti-spoofing research. The same study presents itself as a qualitative, expert-driven analysis and not as a quantitative benchmark, and it is the work of a single author, which a reader should weigh when citing it. Its direction is nevertheless consistent with the dataset authors' own statements, such as the limit stated in the MIDV-2020 paper.

Few documents, few types, few fraud patterns

The size of a collection is not the number of independent situations it covers. MIDV-2020 has 72409 annotated images but only ten document types, and DLC-2021 has 1424 clips of the same ten types. SIDTD forges two ways, according to the survey table in the IDNet paper, and IDNet six. FMIDV applies one manipulation method, copy-move, according to its own page. A result on any one of them is a result for those types and those manipulations. The few-shot results in the SIDTD paper and the cross-type results in the IDNet paper both show what happens when the types change.

Capture conditions are partly fixed by the design

Most of these datasets record documents with a small number of smartphone models in a limited set of conditions. The DocXPand-25k authors criticise MIDV-500 for a single image resolution, only two phone models and the same five environments for every class, and MIDV-2020 for a single photo resolution, low device diversity and a limited number of capture environments. The IDNet paper adds that most remote identity validation services rely on images captured in white light and not on multi-spectral imaging, and that this is the scenario the dataset addresses. Whatever the dataset, a field test on your own capture population remains necessary.

Synthetic faces are not the faces of your applicants

Faces in these collections come from generators. MIDV-2020 uses a StyleGAN-based service, DocXPand-25k uses a diffusion model, and IDNet uses a public set of synthetic portraits. The IDNet authors tested the quality of their portrait set by comparing face morphing detection on synthetic and real data, which is the kind of check any user of synthetic faces should ask for. Face-related conclusions drawn on generated faces say little about distribution across real populations.

A checklist for reading a dataset result

Use these questions before you accept a number reported on any public dataset, including your own.

  • Which task family does the dataset belong to, and is the claim in the same family?
  • Are the genuine documents real, specimens, mock-ups printed on photo paper, or digital renderings?
  • Which fraud patterns exist in the data, and does the claim name a pattern that is absent?
  • Are train and test split by document type, by identity or by background, or can the same background or template appear on both sides?
  • Is the figure from the paper, the repository or a later reproduction, and do these agree?
  • Does the dataset licence allow the use you intend, and does it impose conditions on models trained on it?
  • Was a baseline that fails reported, and what does the failure show?
  • Has the result been repeated on a sample of your own documents and devices?

Where this sits in a verification flow

Document checks in a verification flow are measured on the documents and devices that the flow meets, and public datasets are one input to understanding a method. The document step of a NeuroVision verification session detects, classifies and reads IDs. It reads printed and handwritten text and the machine readable zone with its checksum, and it carries signature and stamp checks. Document anti-fraud covers screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors, and it is included in every package. To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us