Using a stolen identity to get a genuine passport involves the use of relatively easy-to-obtain “breeder documents” — also called “foundational documents” — which are then used to get other pieces of identification.

The breakdown of internal controls and infrastructure in war-torn or developing nations makes this process relatively simple there, says former UK Border Agency officer Simon Horswell. But it’s still far simpler to get a so-called real fake US passport, which allows for visa-free travel to 147 countries, making it the most powerful passport in the world, than most people probably realize.

In the US, a birth certificate is the most common breeder document. It establishes proof of identity and is a conduit to obtaining, among other pieces of identification, a Social Security card, a driver’s license — which can be used to board any domestic flight — and a US passport.

Across the country, birth certificates are issued by thousands of individual state and local vital records offices in addition to a variety of private entities, including churches and midwives. With no national standard, birth certificates come in thousands of versions and incorporate varying levels of security. Some are reasonably secure, while others “could be replicated by a 12 year old on their computer,” legendary forger and imposter Frank Abagnale tells VICE News.

In many places, the security measures taken to protect the physical documents far exceed the steps taken to vet and monitor the people issuing the documents. Abagnale, whose criminal career was the basis for the 2002 movie Catch Me If You Can, and who now works as a security consultant in Washington, DC, says these employees can generally be paid off with relative ease, which has resulted, not surprisingly, in fairly regular cases of fraud aided and abetted by corrupt government officials, both in the US and abroad.

As easy as it is to obtain a birth certificate with fraudulent documents — in California, people need just a notarized statement saying they are who they say they are — some places don’t even have those barriers, even if you’re not physically in the United States.

“Vermont is one of the last states that allows any person, anywhere in the world, to request and receive a certified copy of a birth or death certificate with no questions asked and no tracking,” says a highly critical January 2015 report to the Vermont legislature by the state’s public health statistics chief.

‘We’re talking about a relatively inexpensive step that would close an obvious loophole. It’s certainly cheaper than hardening cockpit doors.’

Under current statutes, Vermont’s state vital records office “lacks the authority to deny any request for a copy of a birth or death certificate or request proof of their need for the certificate.” No red flags are raised if someone requests the birth certificate of a missing or kidnapped child, and no pre-employment background screening is conducted on any potential vital records employees. Vermont has no system in place to identify unusual patterns of requests for birth certificates, nor is there any way to determine if a particular person’s certificate is getting an unusually high number of requests.

Vermont is not alone. In Ohio, if someone can provide a person’s name and date of birth, state employees are legally required to hand over the person’s birth certificate. In one case, officials were forced to set aside their suspicions and fulfill an order for 4,577 copies of different people’s birth certificates from a single requester. New Mexico, another open-records state, has faced similar problems with identity thieves using their birth certificates as breeder docs. According to state official Demesia Padilla, ID fraud there has been linked to international crime syndicates in “Mexico, Bolivia, China, the Middle East, you name it.”

“If there was no solution to any of this, I’d say, ‘Hey, don’t waste your time, there’s nothing anyone can do,'” Abagnale says. “But there’s plenty we can do. We’re just not doing it.”