A document check earns its fee by being cheap and hard to fake at once: the features that settle it are invisible under ordinary light and show up only under ultraviolet or infrared, and a bank reads those rather than the front of the card [17]. Copy the captures and the fee survives while the decision does not, which is the narrow point Tim Rawlins, senior adviser and director of security at NCC Group, made to American Banker when he said the document "carries less evidential weight in any process that relies on it alone" [14]. IDScan.net's own figure, more than 21 million verifications a month at more than 20,000 locations [6], works out to roughly 1,050 checks per site per month, call it 35 a day [1], and about 252 million a year [2]. Nexus's claimed catalogue of more than 153 million licenses [1] is around 7.3 months of that stated throughput [3] - a comparison of scale, and nothing about where the records actually came from. American Banker could not confirm the reporting, because the site went offline within hours of publication behind a message reading "This service is no longer available" [4], and it is unclear whether any of the licenses came from banks or credit unions at all [13]. The part that compounds is retention. IDScan's marketing tells its bank and credit union customers it will save an image of every ID it scans [10], and the record Krebs found for his own license listed six files, front and back in ordinary scan, in infrared and in ultraviolet [18]. Verification itself is a flow business, but saved images pile up into a stock, and that stock is what the New Orleans suits will try to size. Distribution is the other half of the puzzle. IDScan reaches some customers through the Jack Henry Fintech Integration Network, whose pitch is that it speeds integration by "removing the financial institution as an intermediary while the work is completed" [19][11]. Jack Henry's spokesperson said IDScan had notified it that Jack Henry is not impacted [12], which is an assurance sourced to a vendor that has not explicitly confirmed a breach [8] and whose partner-integration page now redirects to a contact form carrying a callout for anyone worried their information was in a security incident [9]. If the images came off retail age-check counters rather than account opening, the exposure at banks sits in contract and reputation, apart from fraud loss [13]. A scoped record count from IDScan turns five proposed class actions [7] into a settlement number and caps the tail. And if Rawlins is right that closing a marketplace "does not prove the files were deleted or that they were never copied elsewhere" [16], the captures keep circulating and nothing about the shutdown matters to a bank's controls. The durable cost here falls on the buyers rather than the vendor: any institution that treated the ultraviolet and infrared read as decisive now needs a second factor behind it, and second factors cost more per account than reading a card. What would break that thesis is narrower than it looks. If the timestamp matching on nine licenses against travel and rental records [3] does not hold, the chain to this particular vendor goes with it; or rather, the more interesting version, if the capture read is already one input among several a bank cross-references, then Rawlins's qualifier about a process that relies on the document alone describes a process few banks run, and his line that a customer "cannot reset their face, date of birth or identity document history" [15] is a fair warning about people, separate from any loss estimate for banks.
