In the core rulebook, there is a section about checking fake System Identification Numbers (SINs) which details on how the SIN check is handled mechanically (p. 368):
In game terms, the gamemaster should make a Simple Device Rating x 2 Test with a threshold equal to the rating of the fake SIN (use Device Ratings, p. 234, for SIN verification system ratings).
However, I wonder what is actually going on in the game world, both for role-playing it and for planning the run settings as a GM.
The SINs seem to contain a lot of information such as DNA samples and retina scans. In addition, background information on the person is attached to it in some database.
How can I imagine different SIN checking device ratings to operate?
A rating one device would probably only check, like, the sex and age, probably entered by the operator themselves.
A rating two device might additionally take a retinal scan and check it against the data in the SIN.
A rating three device could also take a DNA sample, e.g. from saliva or blood.
A rating four device ...?
I’m also thinking through this from a security perspective. If I read the rules correctly, the SIN is also stored on the Commlink (it has to be stored somewhere, I mean, it is likely a 100+ character string, you don’t simply remember that, and I don’t think anyone still believes in paper in 2075. Also, p. 221 “A commlink is combination computer, […], passport, wallet, credit card, […]”). What would stop a decker from simply copying the SIN from a cracked victim commlink and using it (with respect to the rules) like a Rating 1 Fake SIN? (Assuming the victim has roughly matching age and sex)
So to summarize the questions:
What do different SIN check levels look like?
Is the background information ever checked in an automatic procedure?
Is there anything in the checking procedures which protects against a SIN being copied or is it inherently impossible to steal a SIN from another person?