Social engineering is really powerful, since the people you are engineering usually have elevated access privileges. In the ID scenario, presumably there are fake ID providers one could use, although with facial recognition in common use, maybe that scenario becomes harder.