Line art on a banknote or other security document is slightly changed to effect the encoding of plural-bit digital data (i.e. the banknote is digitally watermarked). When such a banknote is thereafter scanned, the resulting image data can be recognized as corresponding to a banknote by detection of the encoded data. (Alternatively, the image data can be recognized as corresponding to a banknote by machine detection of other forms of watermarking, or by reference to visible structures characteristic of banknotes.) In response to detection of a banknote, the detecting apparatus (e.g., a scanner, photocopier, or printer) can intervene so as to prevent or deter counterfeiting. For example, the apparatus can interrupt a copying operation, and display a message reminding the operator that it is illegal to reproduce currency. Another option is to dial a remote service and report the attempted reproduction of a banknote. Yet another option is to permit the copying, but to insert forensic tracer data (e.g. steganographically encoded binary data) in the resultant copy. The tracer data can memorialize the serial number of the machine that made the copy and/or the date and time the copy was made. To address privacy concerns, such tracer data is not normally inserted in photocopied output, but is so inserted only when the subject being photocopied is detected as being a banknote.