Why does this even have to be discussed? It's the responsibility of every project or exchange requesting for KYC to run confirmations on what is actually submitted. Why then are you asking for ID card when you don't have a means to proof its authenticity. You might as well just stop asking for the KYC
You can by pass KYC restrictions on exchanges but you will be in real time if there is a time comes to confirm your identity which occurs if you deal with huge amount so never every try to give fake IDs or your funds will stuck there permanently.