DHS RIVR Results Expose Major Gaps in ID Document Validation Performance

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) has published results from the Identity Document Validation (IDV) track of the 2025 Remote Identity Validation Rally (RIVR), providing a side-by-side look at how commercial document validation subsystems perform on genuine U.S. state-issued IDs versus fraudulent documents captured on modern smartphones. The data show wide performance dispersion across aliased systems, with some subsystems keeping false accepts near 1 percent while others accepted a majority of fraudulent documents, and some configurations rejecting large shares of genuine IDs.

The RIVR program evaluates remote identity validation workflows that combine document authentication, selfie “liveness,” and selfie-to-ID matching in smartphone capture contexts, extending DHS’s broader benchmarking work for remote identity verification and onboarding security. In March 2025, DHS outlined RIVR as a structured effort to test identity verification systems across document and biometric modalities under a consistent design, with results published through the Maryland Test Facility and vendor systems anonymized under information-sharing agreements. DHS has framed the program around repeatable measurement of security, accuracy, and usability tradeoffs, and subsequent RIVR reporting has highlighted how performance variation can translate into procurement and requirements decisions in real deployments.

The new IDV tables focus specifically on Document Validation Subsystems (DVSs) and whether they classify genuine state IDs as valid and fraudulent IDs as invalid. Document images were captured in controlled environments on three smartphone models (iPhone 14 Base, Google Pixel 7, Samsung Galaxy S22), and subsystems attempted to process both the front and back images of each credential.

Fraud acceptance ranged from under 1 percent to more than 70 percent

The sharpest contrast in the IDV tables appears in the Document False Accept Rate (DFAR), which measures the share of fraudulent documents a subsystem deemed valid. One aliased system, DVS 6, posted DFAR values between 0.0062 and 0.0088 across iPhone 14 Base, Google Pixel 7, and Samsung Galaxy S22 captures, corresponding to 12–17 false accepts out of 1,938 fraudulent documents per device. At the other end of the spectrum, DVS 1 recorded DFAR values between 0.7126 and 0.7668 across the same devices, accepting 1,381–1,486 of 1,938 fraudulent documents as valid. DVS 7 also showed high and device-sensitive fraud acceptance, with DFAR ranging from 0.3916 on iPhone 14 Base to 0.6920 on Pixel 7 and 0.4871 on Galaxy S22.

Several other subsystems clustered in the middle, with DFAR around 0.05–0.14 depending on DVS and device. The spread suggests that, even under a common test design and controlled capture, “document validation” can represent meaningfully different fraud-resistance profiles depending on the subsystem chosen.

False rejects and state sensitivity point to onboarding friction risks

On the usability side, the Document False Reject Rate (DFRR) shows how often genuine documents were rejected, either due to a system error or a determination of invalidity. Here again, outcomes diverged sharply. DVS 5 reported low DFRR across devices, including 0.0059 on iPhone 14 Base and Pixel 7 and 0.0020 on Galaxy S22. DVS 6 ranged from 0.0177 to 0.0315 overall, while DVS 2 ranged from 0.0507 to 0.0630. In contrast, DVS 7 ranged from 0.0787 to 0.6073 overall depending on device, and DVS 4 showed exceptionally high false reject rates, including 0.9729 overall on iPhone 14 Base, 0.6329 on Pixel 7, and 0.7651 on Galaxy S22.

The state breakout highlights brittle points that can surface as uneven pass rates across jurisdictions. DVS 1 rejected District of Columbia (DC) genuine IDs at 0.9818 across all three smartphones, rejecting 54 of 55 DC documents in each device set. DVS 4 also showed extreme state-level behavior, including 1.0000 DFRR for California (CA) genuine IDs on iPhone 14 Base and 1.0000 for DC and Virginia (VA) on Samsung Galaxy S22.

Processing reliability varied, but “no errors” did not imply strong validation

The report also provides System Error Rates (SER), which capture the proportion of documents a subsystem could not process. Multiple subsystems posted zero system errors across all devices and categories in the table, including DVS 6 and DVS 7, while DVS 5 posted near-zero SER with a single error recorded on Pixel 7 in the “overall” category. The fraud and false-reject tables, however, show that low processing errors are not a proxy for effective validation outcomes.

In a parallel RIVR track focused on selfie match to document, DHS has also published anonymized results comparing selfie-to-ID verification performance across vendor systems, underscoring how the same benchmark structure can expose different failure modes depending on whether a subsystem is primarily balancing fraud resistance, user friction, or operational robustness. Recent RIVR Selfie Match to Document results similarly emphasized that apples-to-apples evaluation can influence vendor selection, procurement requirements, and deployment design choices across both government and commercial onboarding.

DHS notes that the IDV track used genuine U.S. state-issued ID cards validated by a multi-spectral government ID validation tool, and that fraudulent documents were collected in partnership with the DHS Homeland Security Investigations (HSI) Laboratory. One genuine ID captured on the Samsung Galaxy S22 device was removed from analysis due to insufficient image quality.

The results are published with an attribution and share-alike provision and do not constitute endorsement by DHS S&T, the Maryland Test Facility, or SAIC. Organizations seeking to contact one or more participating companies can email peoplescreening@hq.dhs.gov and specify the aliased systems of interest. Additional RIVR materials and test design information are referenced through the Maryland Test Facility website at mdtf.org.

Source: DHS S&T / Maryland Test Facility (MdTF)

–

By Ji-seo Kim and Alex Perala