How to tell if an SD card is fake

Every SD card carries its own identity in a set of registers that the host reads the moment the card is inserted: who made it, which product it is, its serial number, its manufacture date, its capacity and the speed classes it supports. The label on the front is printed by whoever sold it. When the two disagree, the registers win.

What we found in five cards bought online

In September 2026 we bought five microSD cards on a marketplace, sold under a well-known laptop maker’s name and labelled 64 GB, 128 GB, 256 GB, 512 GB and 1 TB, with V60, UHS-II and A2 printed on each. Their registers told a different story.

Label	Registers
64 GB to 512 GB, V60, UHS-II, A2	Manufacturer ID 0x00, which is assigned to nobody; blank OEM field; the same product string and the same manufacture date on all four; Speed Class 4; SD specification 2.0; a 12.5 MB/s bus
1 TB	A capacity of 4.23 GB, a serial number of zero and a manufacture date of January 2000

A capacity test on the “64 GB” card, which writes tagged blocks across the claimed range and reads them back, found that every block above 128 MiB came back wrong. The card holds at most 128 MiB. The “1 TB” card did not need testing: it declares 4 GB itself.

The tells, in the order a device checks them

1. Manufacturer ID zero or unassigned. Real makers have registered IDs. Zero means nobody claimed the chip.
2. Impossible combinations. V60 requires a UHS-II bus, and the application classes A1 and A2 are defined for UHS cards only. A card that negotiates the 2006-era SD 2.0 interface at 25 MB/s cannot be either, whatever the label says.
3. Serial numbers that repeat. In a separate batch of nine cards sold under an industrial maker’s label, two different cards carried a byte-identical serial. A production line does not issue the same serial twice.
4. Capacity that does not survive a write test. Counterfeits programme a small flash to advertise a large size. Writes past the real size either wrap round and overwrite the start of the card or vanish. The copy reports success either way; the read-back does not.

How to test capacity yourself

Free tools do it: h2testw on Windows, F3 on Mac and Linux. They fill the card with test files and read them back, which takes as long as writing the whole card, an hour or more on a large one. Our handheld does the equivalent in a few minutes by writing probes on a ladder of offsets and reading those back, because any fake with a power-of-two flash size is caught at the first offset that lands on a reused block.

What we do with fakes

We report what the registers and the tests measured, with the numbers. We do not issue a health certificate or recertify a card whose identity cannot be trusted, however well it reads. A fake that still holds data gets a verified erasure or destruction, with evidence, and a report that names the anomaly. See supported media and how we test for the register data we publish per brand, with sample counts.