Have you tried sending them a fake ID? As I understand, these companies are verifying the format of the ID, not the exact details on it. Including all the subtle format details like the checksum of the OCR section. If it looks good, they add it (and the site you were trying to access, and the timestamp) to their database.