Now this is pure speculation.
In such cases we can not generalise this "can happen" type malpractice.
We know by experience and in practice that creating fully fake id is not a common or easy thing and for tout still PRS is best place. Rarely any IRCTC agent risks his business.