If there won't be a callback into governmental database, you can make stuff up as you go with something what resembles correct ID. If there will be callback into gov database, you can just query it and mine valid IDs using gov database as an oracle.
a lot of people still scan their id but theoretically fraud prevention is possible