# Detect tampered and deepfake EAD Card (Employment Authorization) > An Employment Authorization Document, or EAD, is the photo credential USCIS issues on Form I-766 to non-citizens whose status permits them to work in the United States for a defined window, and employers use it for I-9 onboarding while lenders read it as income-bearing status proof. Everything of value sits in the category code and the validity dates, so fraud stretches an expired card, fakes a category, or pairs one holder's face with another person's A-number. **Canonical URL:** https://tampercheck.ai/documents-support/ead_card **API document class:** `ead_card` --- ## What a genuine employment authorization document contains The card carries the holder's photograph, name, A-number, and a category code that encodes the legal basis of the authorisation, such as C09 for a pending adjustment application, C33 for DACA, or A05 for asylees, bounded by card-valid and card-expires dates. The category should agree with the applicant's claimed status, and the printed window should fit what that category normally receives. EADs run for fixed terms, commonly one to two years, tied to the underlying case, and renewals produce fresh cards rather than extensions of the old one, so a stale card is not automatically cured by a receipt notice. Adjustment applicants frequently hold an EAD and a pending application at once, which gives verifiers a natural cross-document check on the A-number. ## How employment authorization document forgeries are made ### Validity-window edits The card expiration date is the primary target, with a stale card kept alive by one or two substituted digits. Comparing print passes across the date line exposes a patch the rest of the card hides. ### Category coherence Codes such as C09, C33, and A05 each map to a legal basis with typical grant lengths. A category whose normal term contradicts the printed window, or whose basis contradicts the holder's claimed status, is a coherence failure. ### A-number agreement The A-number must match the holder's other immigration documents. Reusing one person's portrait with another person's biographic data produces a composite that cross-document comparison breaks open. ### Edition and print checks USCIS has issued several EAD designs over the years, each with its own layout and security features. A card that mixes generations of design elements was assembled rather than issued. ## What TamperCheck checks on an employment authorization document TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class. ### Portrait substitution and face-swap analysis The document is isolated from whatever it was photographed on, then the portrait region is assessed against the card surface around it. A pasted or generated face rarely matches the substrate it was placed onto. ### Security print, foil, and hologram analysis A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen. ### Date and validity consistency Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension. ### And many more checks The three above are the layers that carry the most weight on an employment authorization document. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks. ## Who verifies an employment authorization document, and why US employers completing I-9 checks and HR onboarding teams. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging. ## How to verify an employment authorization document in 4 steps 1. **Photograph both sides.** Capture the card flat and complete, front and back, at full resolution so the category code, both dates, and the portrait survive forensic analysis. 2. **Read category and dates.** Note the category code and both dates, then weigh whether the printed window fits what that category normally receives and what the applicant claims their status to be. 3. **Cross-check the A-number.** Match the A-number against any green card, visa, or receipt notice in the file. A mismatch across documents is a composite-identity signal, not a print defect. 4. **Run a forensic check on the file.** Category codes and date lines are small targets for manual review. TamperCheck runs 200+ forensic checks across the dates, the category line, and the portrait, and returns a risk score from 0 to 100 with findings tied to specific regions of the image. ## Frequently asked questions ### What is the difference between an EAD and a green card? An EAD grants permission to work for a bounded window without changing immigration status, while a green card establishes permanent residence. Many adjustment applicants hold both an EAD and a pending application, so the two documents in one file are complementary rather than contradictory. ### Can someone work with an expired EAD? Not on the expired card alone, though a timely renewal can trigger an automatic extension of the old card for a defined period in eligible categories. Verifiers should ask for the receipt notice and check that its category and dates line up with the expired card it claims to extend. ### What does the category code on an EAD mean? It encodes the legal basis of the work authorisation, such as C09 for a pending adjustment application, C33 for DACA, or A05 for asylees. The code anchors the coherence checks, because each category carries an expected grant length and a supporting case type. ### How does TamperCheck analyse an EAD? TamperCheck weighs the category code against the printed validity window, checks the A-number for cross-document consistency, and inspects the date line for substituted digits. Uploads go through a single REST endpoint, are processed ephemerally and not stored, and return findings tied to specific regions of the card. ## Related document types - TamperCheck Forensic Report: https://tampercheck.ai/documents-support/forensic_analysis_report - Unknown: https://tampercheck.ai/documents-support/unknown --- Try TamperCheck now: https://tampercheck.ai/dashboard · Docs: https://tampercheck.ai/docs · Pricing: https://tampercheck.ai/pricing