Well we cheated a bit there as we used the images the document scanner recorded and put that on a phone. So we had exactly the images the scanner expected, but

Well we cheated a bit there as we used the images the document scanner recorded and put that on a phone. So we had exactly the images the scanner expected, but it is not an unreasonable assumption that a document forger would have access to such a device. In the final version we had it running on an Android device. We did know the exact scanning sequence and timing (first IR, second visible light, third UV exposure) so the phone showed the IR image by default and used the brightness sensor to detect the first flash of the recording, then an internal timer ran to determine when to switch to the second and third image. If I recall correctly the digital part was done with JMRTD [1] flashed to an empty smart card The certificate check obviously would have failed, but as mentioned in a comment above that is not always an issue. [1] https://jmrtd.org/about.shtml https://jmrtd.org/about.shtml