Can Door Staff Legally Confiscate a Fake ID? Rules, Protocol and Logging

A card fails the check. It is clearly not genuine, or it is genuine and clearly not theirs. Your door supervisor is now holding someone else’s property, and has about four seconds to decide whether to give it back.

Every instinct says keep it. Handing a counterfeit back means it gets used at the bar down the road within the hour, which is why door staff who have been doing this a while tend to have a drawer. But whether keeping it is lawful depends entirely on where you operate, and getting it wrong exposes you to a claim of theft or wrongful seizure from someone who — occasionally — turns out to have been holding a real licence after all.

This is a question with a genuine answer for your venue. It just is not the same answer everywhere, and the honest version of this post tells you how to find yours rather than pretending one rule covers the country.

Not legal advice. Confiscation authority is set by state statute and sometimes by local ordinance or your own licence conditions. Confirm yours before writing a policy around it.

The three positions states take

States fall into roughly three groups, and knowing which one you are in is the whole of the legal question.

Expressly authorised. Some states specifically permit a licensee or their staff to seize an ID reasonably believed to be false. Where this exists it usually comes with conditions attached — commonly a requirement to hand the document to law enforcement within a set period, and in some cases to give the patron a written receipt recording that the card was taken, by whom, and where they can reclaim it. The authority and the conditions are a package; taking the card while skipping the receipt or the hand-off is not partial compliance, it is non-compliance.

Expressly prohibited or not provided for. Other states give no seizure power to private security, and the expected response is to refuse entry, return the document, and report it. In these jurisdictions a doorman who keeps the card has taken property without authority — regardless of the card being fake, and regardless of good intentions.

Silent. No statute either way. This is the uncomfortable middle, because silence is not permission. General property and theft law applies, and the practical answer usually comes from your local police or licensing officer, who will have a settled view about what they want venues to do. Ask them; it is a five-minute conversation and it is the one that actually governs how an incident gets handled locally.

There is no shortcut here, and a table of all fifty states would be the wrong thing to trust — these provisions get amended, and a stale row is worse than no row. What you want is one phone call, once.

Finding your answer in one phone call

Call your state alcohol control board, or your local licensing officer, and ask exactly this:

“When my door staff identify a false ID, are we permitted to retain the document? If so, what are we required to do with it and in what timeframe? If not, what do you want us to do instead?”

Write the answer down with the date and the name of the person who gave it, put it in your door policy, and re-check it annually. That record is itself useful if an incident is ever reviewed — it demonstrates that your protocol was deliberate rather than improvised.

The protocol, whichever answer you get

Most of the door procedure is identical in all three cases. Only step three changes.

1. Refuse calmly, and without an accusation. “This hasn’t passed our check, so I can’t let you in tonight” is a statement about your process. “This is fake” is an allegation about a person, in front of their friends, and it is the sentence that turns a non-event into an incident. Your staff are not the ones who have to prove anything — they only have to decline entry, which they may do without giving any reason at all.

2. Never detain, never escalate over a card. No physical restraint, no blocking someone’s path, no grabbing. A counterfeit licence is not worth an assault claim, an injury, or the licensing consequences of a violent incident on your door. If someone becomes aggressive, the correct move is to de-escalate, let them leave — with the card if that is what ends it safely — and report it afterwards. A document is recoverable. A serious incident on your record is not.

3. Handle the document according to your state’s answer. Either return it, or retain it under whatever conditions apply — receipt to the patron if required, and hand-off to police within the required window.

4. If you retain it, secure it properly. Straight into a locked, tamper-evident box at the door, logged at the moment it goes in. Never into a doorman’s pocket, never into an unsecured drawer, never home with someone at the end of the shift. A confiscated document in a personal pocket is the single fact most likely to turn a routine refusal into an accusation you cannot answer.

5. Log it, every time, including the refusals where nothing was taken. More on this below, because it is the part that protects you.

Why the log matters more than the card

Here is the scenario that should shape your policy.

Someone returns the next day, or their parent does, and says their genuine licence was taken by your door staff and never returned. Perhaps that is a chancer. Perhaps your doorman got it wrong — good genuine cards from unfamiliar states do get refused by tired staff, and it happens more than anyone admits.

What can you produce?

A shoebox of cards and a doorman’s recollection is not an answer. It establishes neither what was taken, nor when, nor by whom, nor on what basis, nor where it went afterwards. You are in an argument you cannot win on evidence, and the same gap exists if a police officer asks you to account for a document you say you handed over three weeks ago.

What closes it is a chain of custody: an entry made at the moment of the incident recording the time, the entrance, the member of staff, what specifically failed the check, what was done with the document, and — if it was surrendered — when and to whom. That turns “we think so” into a record.

This is the same principle as the affirmative defence argument for scanning generally. It is not about catching everything. It is about being able to demonstrate exactly what your team did, on that night, with that person.

What to log, and what not to

Worth being careful here, because an incident record is one of the few places where a venue has a legitimate reason to keep identifying data — and it is easy to over-collect.

Log: timestamp, entrance, staff member, device, what failed and how, the action taken with the document, and the police reference if there is one.

Consider carefully: the parsed contents of the card. There is a reasonable argument for keeping it on a flagged incident — that is what distinguishes an incident record from a routine entry — but it should be a deliberate, individual act attached to a documented cause, not something that happens automatically to everyone who fails a check.

Keep separate from routine entry logs. Your ordinary scan records should be purging themselves on a schedule; your incident records should not be caught up in that, and your incident records should not quietly become a general database of everyone who was ever refused. Two stores, two retention rules — retention varies by state, so set them to yours.

Do not build an informal shared blacklist of individuals across venues without understanding what your jurisdiction permits. Operators do this informally over messaging groups all the time, it feels obviously sensible, and it is data processing about identifiable people with none of the safeguards a formal scheme would require. Some regions have properly constituted venue-sharing schemes with a legal basis and an appeals route. Join one of those rather than starting a group chat.

Train it before you need it

The failure mode is not that staff do not know the rule. It is that the rule was never rehearsed, so under pressure they improvise — and improvisation at a door at 1am tends toward either confrontation or waving it through.

Put it in writing on one page: refuse calmly, do not detain, this is what we do with the document, this is what gets logged, this is when a manager gets called, this is when police get called. Then walk your team through it, including the awkward version where the patron insists the card is genuine and is loudly upset. Ten minutes at a staff briefing, repeated when new people start.

The venues that handle this well are not the ones with the strictest policy. They are the ones whose door staff have said the sentences before.

Where we fit

We are building the phone version, and the incident record is a large part of why. Reading the barcode is the easy half; producing a timestamped, exportable account of what failed, who was on the door, and what happened to the document is the half that matters when someone asks you to account for it weeks later.

Not shipping yet, and we are not going to pretend otherwise. If your state has a confiscation rule that a product ought to accommodate, the early access list below is where to tell us — that is exactly the kind of detail that should shape it now rather than after launch.