The attack is simple:

A criminal gang starts scanning lots of cards. This can take place at airports, concerts and so on. The actual person doing the scanning is a low-ranking know-nothing who is just following orders. Disposable.
The scanned details go into a large database controlled by the gang. It will contain tens or hundreds of thousands of cards.

Someone wanting a card goes to the gang and sits in front of a camera. The face scanner looks at their facial geometry and gives a list of cards which have faces which look closest. Pick one, pay up and you've got yourself a new cloned ID in minutes.
Forgery? Not in this century.

Facial is sufficient for most uses envisioned by Big Brother. For instance, if you have an Australian passport, you probably already know about the new walk-through system being introduced for Genuine Aussies. Go through the channel, the facial recognition system remotely reads your card, looks at your face and lets you go through.

Don't be too surprised if armed police bust into your home at 6AM. If I were going to do a kidnapping or murder, I'd be carrying a clone of someone else's ID.
Yours would do. Nothing personal.

How do you revoke your ID card without establishing your ID?
How do you establish your ID without your ID card?
How long does it take to empty your savings account and max out your credit?

This is one reason why you should have separate cards for identity and authorization (purchases/bank accounts/etc), and why you should keep your ID card in a safe place, where it won't get stolen along with your DoStuff[TM] Card in your pocket.