Why does this even have to be discussed? It's the responsibility of every project or exchange requesting for KYC to run confirmations on what is actually submitted. Why then are you asking for ID card when you don't have a means to proof its authenticity. You might as well just stop asking for the KYC