Abstract: A method of identifying a valid bearer of a token such as a travel ticket (2) comprises the following steps. First of all, a token issuer (110) receives an image (3) of the valid bearer, and records within or associates with the token a representation (4) of an identifier associated with the image without recording the image on the token. The token issuer (110) communicates with an image recovery service (120) for storage of the image and the associated identifier or transformation of the identifier at the image recovery service. A token examiner (130) obtains the identifier from the token, and uses the image recovery service (120) to obtain the associated image or encrypted image from the identifier or transformation of the identifier. The token examiner may use the associated image to determine that a bearer of the token is the valid bearer. Suitable apparatus is also described, together with specific methods and apparatus for issuing and inspection of tokens and implementation of an image recovery service.