# How to verify or establish identity where shapeshifters exist

No magic exists in this setting beyond what is explicitly described in this quesiton. The setting is vaguely European medieval. The question centers around a town large enough to support a nobleman complete with his keep.

The town knows that shapeshifters live in the wild. The populace has yet to determine the creatures' motivation, but the shapeshifters act to seed as much death and destruction upon the town as possible. Efforts to have a civil discussion with the shapeshifters have failed, and nobody knows where they live, except somewhere in the nearby wild (forests, valleys, and rolling hills). Hunting bands haven't located their homes.

They seem equally intelligent--if not more so--than humans, and reports show that they can shift perfectly into a human form within seconds. The exact human form only seems limited to their creativity or knowledge of a specific human's form (if they don't know about a birthmark, they can't reproduce it). They are known to kidnap humans to study them exactly.

The shapeshifters have no other known intrinsic abilities. Any container, wall, or shackles that could stop a human can stop a shapeshifter.

The nobleman is fairly certain, however, that the people of his town drastically outnumber the shapeshifters by the manner of their tactics and time between incidents (no outright attacks, less than a half dozen shapeshifters involved in any one incident), and shapeshifters can be killed, restrained, or otherwise directly dealt with as easily as humans can, so there's hope.

If kept days without food (about a week), the shapeshifter's form will begin to grow sloppy. Likewise corpses will slowly shift back to its gray, nebulous, humanoid form as they begin to rot. These methods can be used as an ultimate means of determining if a given being is human or creature, however neither of these methods are particularly practical.

The town can't simply prove everyone is human and then lock themselves behind a wall, since the local industries of farming, logging, and mining are essential, and trade is conducted with the neighboring communities. The town needs some practical means of establishing a creature as human, or maintaining verification.

Since appearances can be copied, a passphrase can leak or be tortured out, a physical token (like a badge) can be stolen, and (the most recent attempted method) tatoos can be copied (once discovered), it's difficult to solve this problem.

What are possible policies the town can adopt to establish a being's identity, or maintaining verification?

• Does a shapeshifter's personality remain the same in their different forms? In other words, are they the same, mentally, all the time? – HDE 226868 May 31 '17 at 14:11
• Do the shapeshifters exhibit a pain response when their hair is cut? If they do then it can become custom to carry a scissor with you and cut off a bit of hair from the person you're meeting. – Visfarix May 31 '17 at 18:21
• You say passwords can be tortured and physical tokens can be stolen, which is basically saying "any form of identification can be broken". This is true in the real world too. There is no perfect, unbeatable solution. – BlueRaja - Danny Pflughoeft May 31 '17 at 20:49
• How can shackles stop a shapeshifer? Can’t he just shrink the body part that's catching? – JDługosz May 31 '17 at 21:29
• Do you need exact identity or is whether or not it's a shapeshifter enough? I vaguely recall a story or two that had some sorts of blood tests – a different color of blood, or there's some change when exposed to air or a chemical or herb. Just poke a suspect's skin enough for a drop or two of blood. – Kevin May 31 '17 at 22:56

# Dogs, Fasting, Passwords and Tokens

Modern IT has a similar issue. It is generally handled by having a physical token and a user known password that changes regularly and is unique for each user and both are securely handed out.

Add a kidnap password that includes a coded message of location(if known by kidnappee) and when the shapeshifters try to use it they can then be located and eliminated. A simplified example would be: Everything is fine password=EIFP Come save me I'm at the fork in the river= CSMIATFITR

Make the physical token something that the person doesn't know themselves and that can't be tortured out of them. Eg while the person is asleep write a number in invisible ink on their back and check for it when the person gets back. The person doesn't know they are carrying it, doesn't know what it consists of, so they cannot compromise it under torture, nor could they tell the shapeshifters how to read it and duplicate it. There are plenty of these that were available in the middle ages, (eg lemon juice or alum) but the right one might be tricky.

Also, a week isnt a particularly long time for humans to go without eating, so implement random week long fasts (It is the random-week-long-fast festival, we store food in the city granary, and prepare for the big feast!), control food going in and out and have your whole population watch for and report strange behavior. Use dogs to find illicit food.

Additionally, being basically all medieval towns had dogs, dogs could be used to sniff out shapeshifters. If they don't have any scent dogs could tell that- which makes finding them in your population easy, and the scent of the items carried could still be followed to the nest, or if they adopt the scent of the person captured, the persons scent could easily be tracked back to the source and the whole nest eliminated, and dogs work in packs so (if they can take a dogs shape) a compromised one would not particularly matter. Dogs take care of the whole problem rather quickly, even just with the information given in the question dogs would wrap this up by following the scent on the clothes worn by a shapeshifter back to its nest (though if you had only one dog and it was compromised that would be a huge problem!)

Beyond that, I could see a funny practical joke people play on each other develop. That is to call others "shifty" and get them a week living in luxury in a super comfy bed in jail fasting, reading books, and playing games. No reason to make it miserable if there is a good chance the person is normal.

Finally, keep really good logs of where each person is, who comes in and out of the town, and always, always travel in groups.

• Dogs. Great answer, no amount of shape-shifting can change the way you smell, and so with no other special abilities, these shape-shifters cannot fool dogs. So every villager/family has to have their own dog. Not sure if someone is who they claim to be? Fetch their dog and see if it recognizes them. Simple and done. (Oh your dog is mysteriously dead or missing? You can wait in the dungeon for a week then or until we find it) – RBarryYoung May 31 '17 at 21:18
• ... and this is all assuming that shape-shifters are really some type of human who can change shape. If they aren't human, then it's even easier: they won't smell like humans at all and then you just need a few dogs that can tell the difference. – RBarryYoung May 31 '17 at 21:21
• @RBarryYoung "no amount of shape-shifting can change the way you smell" - The shapeshifters have no other **known** intrinsic abilities - who said we know everything about them? Much like vampires spread the lies that they can't come out in sunlight, are allergic to garlic and are super strong ... what makes you think they don't have hidden, exaggerated or unknown abilities? What better way to stay ahead of the "enemy" than spread misinformation to stupid town dwellers stuck in the stone age... – WernerCD Jun 1 '17 at 2:00
• @WernerCD No the purpose of the statement "The shapeshifters have no other known intrinsic abilities" is to let us know that we do not have to worry about that in the answers. You are choosing to read it as though it means "The shapeshifters may have ANY other abilities" which would make any answer impossible. Clearly that's not what the OP intended. – RBarryYoung Jun 1 '17 at 15:38
• @WernerCD No, I expect the OP to ask the question that they want answered and the repsonders to respect that. – RBarryYoung Jun 1 '17 at 16:48

It all depends on how good the shapeshifting is. Can a shapeshifter imitate something that a human would not be aware it is there - such as all the nuances of personal body smell that a trained dog might recognize? If not, then the answer is simple - employ guard dogs and train them to recognize shapeshifters.

Their density could be different enough from a human's that they could be subject to trial by water.

Their metabolism might be different enough, even in human form, that some substances (roots, berries, extracts of bark...) that are innocuous to a human are either lethal or have a discernible effect on shapeshifters, allowing to reinstate the practice of corsned.

Are shapeshifters something alike The Thing, so that each part of their body is independent of others? If so, a drop of shapeshifter blood drawn from a finger will try to escape an approaching incandescent blade, and betray its nature.

Is shapeshifter matter built the same way as human's? For example, is the smell of their hair, once burned, the same?

Do shapeshifter react the same way as humans? Do they sneeze when inhaling pepper or when a feather is driven in their nose? Do they possess the patellar reflex?

Several tests could be devised and, possibly, those administering the test could be a sort of sacerdotal caste, living constantly protected to ensure they're not infiltrated; and they could lie about the test being administered, to throw the shapeshifters off the trail. They could for example tell people being tested that they've been given a secret drug that will make their eyes red-coloured, and shine a light in their eyes. What they're really testing for is the human photopupillary reflexes.

Then even if the shapeshifters succeed in abducting someone and torture out of him how shapeshifters are ferreted out, they won't be able to acquire a drug that doesn't even exist; and even if they did succeed in turning their eyes red upon inspection, that would only ensure they get caught.

# If the shapeshifting is too good

If the shapeshifters manage to emulate a human down to the cellular level, they will duplicate even complex things like sneezing without even thinking about it. Or if they're telepathic, they'll sooner or later work out how the tests have to work, and devise some way to thwart them.

If this happens, we cannot tell human from shapeshifter from something that a person is, so we must use a different scheme of authentication - something the person knows. Organize people into groups that, while small, are larger than the standard shapeshifting patrol (just in case). The whole group must then undergo a week-long fasting; at the end we will know that they are not shapeshifters. This group will need to live together and swap stories. In a pretty short time, with the appropriate team spirit, each member of the group will know a quantity of things about every other member.

Most importantly, the others will not be aware of everything, in detail, the other members know. And what they don't know cannot be tortured out of them. Nor can shapeshifters keep someone hidden for weeks while having him recount the story of his life, not even if they have truth-sense and can tell when they're being lied to.

When in doubt, instead of having someone spout something that he knows, we ask him for something that he ought to know.

"Hello back, Gayvyn! How was patrol today?"

"Boring and uneventful, Styvon, just as I like them!"

"Very good. So, what did Mariah tell you last Summer's Eve?"

"Duh, I don't remember. You sure you're not making this up?"

"I would? Like Eryk always does in the barracks, you mean?"

"Yeah, that."

"No, I did not. Unfortunately for you, neither did Eryk. MEN, GET HIM!"

## The only thing that can't be copied / stolen is the personnality.

I'm pretty sure that if someone took my appearance, knew some basic things about me, and went back home, my companion would still notice. Even coworkers would still see that something is amiss, despite being a lot less close to me.

In our world, this would be considered a weird behaviour, maybe worrying as it could be a symptom of a brain illness. But in your world... such small oddities would immediatly be recognised as a shapeshifter work. Some further investigations would be conducted, by asking personnal questions. You can torture someone to learn a password, or a few personnal things, but you can't learn all the shared memories, so a quick questionning by relatives should easily remove any doubt.

As medieval communities were quite small, everyone knew... well... not everyone, but a least a large bunch of people in the city/village. Even the guy nobody likes and who lives alone is known, and a change in his behaviour would still be noted.

An issue arise when dealing with complete strangers. When dealing with two parties not knowing each other (like in a trade between cities), a policy of traveling as a group of relatives to guarantee no one is a shapeshifter could be implemented. Of course this could be a group of shapeshifters, but since they're not so many, the risk would be reduced. And the more important the stake is, the more people should be requested.

• But don't actors aim to "steal" personalities? Improve actors especially. – Clangorous Chimera May 31 '17 at 18:04
• @Clangorous Chimera To effectively impersonate someone, the shapeshifter would have to observe and know someone very, very well. Which would require to take the place of one of its close relatives for a long time which in turn would need really good knowledge of its behaviour pattern etc... – Keelhaul May 31 '17 at 19:33
• One day i came to work quite cheerful, and my co-worker immediately asked: 'Who are you? And what have you done to Burki?" – Burki Jun 9 '17 at 9:30

We are fortunate to live in an era where these sorts of security measures are actually rather commonplace. Everyone on the internet is a shapeshifter, if you think about it.

I can think of two security measures from today's cyber world which are highly applicable in this environment. The first is defense in depth. You don't want to have just a single outer wall which "protects" everyone. That wall cannot protect everything to an acceptable level of satisfaction without simply quarantining everyone who comes in for a day or two. Instead, you rely on multiple layers of defense. The outer layers may have to deal with a few shapeshifters, in exchange for better commerce and access. Inner layers may accept more strict access restrictions in return for better guarantees.

You're blessed to actually have a way of determining if someone is a shapeshifter or not. It's brutal, but it works. This means that you can have bastions which are certified shapeshifter free from which decrees can be issued. You might even develop a ritual for entering such a bastion which is proud enough to permit even a king to undergo a week of malnourshment. You'd simply want to make sure this doesn't have to happen all that often!

The other key trick is one from identity verification. There's a famous trifecta for identity. An ideal identity verification requires three things:

• Something you are (biometrics)

Inner sanctums may call for all three, but in the outer layers of your city, you probably wont be able to test biometrics all the time because the shapeshifters are good at mimicking those. Thus your outer sanctums would rely heavily on what you know and what you have.

Decrees from the inner sanctums would likely rely on things you have. Someone descending from the sanctum would likely bring something like a holy seal along with them to validate their identity as one who came from the highly-verified non-shapesifter inner regions. Within the outer regions themselves, passwords would be popular and changed regularly.

For travel between cities, spoilable visas may be very valuable. These would be documents verifying you as human (or more pedantically "most likely human'). These could be used to get access to outer regions quickly with minimum fuss. You would be expected to guard those visas more than your own life. They would be designed to be easily "spoilable," so that an attacking shapeshifter couldn't just steal your documents. This was the approach used for codes in WWII submarines. Codes were printed with water soluble ink, and it was expected that the officers would destroy the book by throwing it in the water if the sub was boarded.

Fortunately for us, the cost of spoiling your visa wouldn't be all that dire. It would just subject you to more intense verification at your destination.

Finally, its always fun to look at Zero Knowledge Proofs. They're a fascinating form of verification which can be done along the lines of modern public key encryption. However, modern public key encryption is not tractable by human minds, so we can't really use it without computers. There are some interesting Zero Knowledge Proofs involving graphs, however, that are actually not that hard for the human mind to master. Some high ranking people may use these to provide a very hard to forage identity in the form of something they knew.

What happens if you set a shapeshifter (or portion thereof) on fire?

Will it begin to shift back as it burns? Will it be reduced to some sort of slag that is visibly different from charred human remains? I'm thinking, in particular, of hair, fingernails and other "expendable" bits of human anatomy.

Cut off a lock of hair and burn it. If it burns like human hair, you're safe. If it melts into a grey amorphous slag, you're a shifter.

• Burn the witc--ah, I mean... Burn the suspected shapeshifter! – Ranger May 31 '17 at 17:38
• That is the method they used in John Carpenter's The Thing. Easy peasy. – Willk May 31 '17 at 19:33
• In addition to "does it burn"... does it float? handy chart – WernerCD Jun 1 '17 at 2:03
• @WernerCD and the logical conclusion... will it blend? – Joe Jun 1 '17 at 11:03

A specialized Voight-Kampff test of cultural awareness.

(For the uninitiated: The movie Bladerunner deals with replicants, androids virtually identical to humans).

People are talking with each other and the game is that you deliberately and inconspicously violate one specific social condition when you talk. Your counterpart then needs to refer to the specific violation and counter with a violation of its own.

A shapeshifter cannot be aware of all the extremely complicated social interactions which are taught in human circles and subconsciously ingrained.

Knight meets a farmer.
Farmer: "Dear sir, may I invite you into my home".
(A knight may not be invited).
(A knight never eats bread, it's low food).
Farmer: "Unfortunately I have only capon, please do not punish me".
(Knights eat capon, after accepting hospitality they may not punish people).
Knight: "I will punish as I please, peasant and if I lay my hand on your shoulder".
(A knight laying his hand of the shoulder is ambigous: It is referred by peasant as "He beats me", but for a knight it is a form of respect).

Pass.

Knight meets a farmer.
Farmer: "Dear sir, may I invite you into my home".
Farmer: "I have everything ready for you. My wife has cooked a meal".
(Knight: ?)
Knight: "Very good, I am hungry. Do your wife also know how to prepare fish?"
(Today is Sunday. It is strictly prohibited for knights to eat fish at Sunday).
Farmer: "Oh yes, incidentally my wife has also very fresh fish".
Knight: (nods and lops head off with sword).

Fail.

The nice thing is that because both participants are changing their violations and invent them on the spot, you cannot predict what violation will occur. Even if the shapeshifters gain knowledge of the game, they cannot extract a lifetime of social conventions out of a person.

• Oh lord. I would fail this test every time. Social anxiety would kick in and all ability to do this extemporaneously would vanish. – CaM Nov 8 '17 at 16:06

You mention that they shift "perfectly" into a human form. Technically, it can't be perfect, since a human can't shapeshift, so there must be some chemical / biological difference, particularly since the tissue reverts upon decay.

Therefore, could a dog smell the difference ?

Would a mosquito, a leech, or a flea drink a shapeshifter's blood ?

If there was an outbreak of influenza, smallpox, measles etc. would the shapeshifters also be affected / infected ?

Or are biological / medical techniques for telling them apart from humans ruled out ?

• Leeches. Great idea. It turns out that prevalence if leeches in medieval medicine is because they are a relic of great shapeshifter purge. In certain region it used to be standard practice to test patient before starting any procedure and other doctors started copying it, completely unaware of real purpose of leeches! – M i ech Jun 1 '17 at 7:00

First, find people you're sure aren't shapeshifters (at the time). You mention that going without food for a week is sufficient to discern whether someone is a shapeshifter or not: thus, confine people in pairs (why pairs will become important later) for a week at a time, giving them only water. Possibly imbue this fasting with some religious or ritual significance.

At the end of the week, if neither is a shapeshifter, they each tell each other a secret, but just as importantly, they'll have spent a week together in close-ish proximity and will have some idea of each other's habits: possibly enough to spot if a shapeshifter has taken their place.

Either person may request this ritual be repeated when they suspect their counterpart is an impostor; given that it involves both parties being confined without food for a week, false accusations are unlikely to be due to malice. Additionally, this can be extended to larger groups or to multiple pairs of people when more trust is required: a village council, for instance, might do its most weighty decision-making while fasting this way: should one of their number turn out to be a shapeshifter, any input they had into the decisions that week can be isolated and filtered out.

(Note: this is similar to theinvisibleduck's answer)

• Arrange passwords, and tell the humans that they don't have to hold out forever if they are being interrogated, merely a day. Morning and evening roll calls where new passwords are given out.
• Give each human an easily breakable token, and tell them to break it if they are in danger of capture.
• Whenever a human must venture beyond safety in numbers, one of the stay-behinds does something very minor to their gear. A scratch on a belt buckle, a rip in the hem of a cloak. If possible something that will change if the victim is forced to undress, and which is too minor to be duplicated by the shapeshifters if they try to duplicate the gear.

If the noble is an evil overlord, he might err on the side of caution and kill all possibly compromised underlings. A more reasonable ruler would let them hunger for a week, followed by a welcome-back-dinner.

• "Hey, if you're being tortured, you just have to hold for a day ! Seems easy right ?". Plus, giving password to all the population twice a day is completely non-efficient : it only needs one shapeshifter in the crowd and the password is compromised. No, really, passwords are not a solution. – Keelhaul May 31 '17 at 14:30

I would rely on visual memory. Specifically, facial memory and picture memory.

This is a kind of password system too, but a challenge instead of a personal password. Even in medieval times, we had art with superb likenesses and intricate artwork. So we have a gate keeper, and in his shack he has a thousand pictures of people's faces and various pieces of artwork that have their own names. (People can easily remember thousands of these, btw, when motivated to memorize them).

To get into the village, get in a cage. The gate keeper will roll some dice to choose three drawings at random. They go in a frame; he flips it: Only you can see it: You have three seconds to name all three in order. If you fail on any one of the three, you remain locked in the cage, he calls security, and you are in for a very long fast; no second chance. If you are not a shifter, expect a few weeks of hard labor and remedial training. Do it thrice and you may not be allowed to leave the village anymore, or indeed be married and have children, because you are defective.

Our gate keepers are kept under 24/7 protection and never leave the village, and we pick people with strong memories and very poor art skills, so even if captured they could not train the shifters to recognize the pictures or know the names of the villagers. And of course the gate keepers and guards are themselves tested every day before taking their post, by the guards of other gatekeepers: Everybody has to know the pictures.

Duplicating the appearance of the human does not duplicate their memory, trained over many years to memorize these thousand images. The complexity and difficulty of that training make it too hard for the shapeshifters to hack.

• Citation needed for "people can easily remember thousands of these." Lots of people have trouble memorizing the names of people and things, and others have trouble recognizing faces. – Kat Jun 1 '17 at 4:08
• @Kat Really? you cannot name a few thousand things on sight? The average person knows 15,000 words; but in the course of college education it is not unusual to add about 8,000 and for a medical doctor about 15,000: quora.com/How-many-words-does-an-average-English-speaker-know -- those words have specific meanings that must be recalled. The idea that for survival people have to learn words that go with 1000 images, like the "name" of whatever is depicted, is not a stretch in the least. The incapable will be treated as disabled, not allowed to wander without close supervision. – Amadeus-Reinstate-Monica Jun 1 '17 at 12:27
• Names of people? I'd be sentenced to hard labour and then imprisoned in the town, and barred from having a wife or children, because I'm terrible at this. Names of things? Yeah... Shapeshifters would probably pick up on things like that pretty quickly. "what's this?" "a horse, a candle, the letter 'a'" This is no different to having to remember many small passwords, only they are the same words used in natural speech... hardly secure. – Baldrickk Jun 1 '17 at 16:26
• @Baldrickk No it isn't the same, you actually do have to remember proper names of actual things. Using things you are familiar with: The name of this painting is "The Mona Lisa", that is "The London Bridge", this is "The Sydney Opera House," that is "Haight Ashbury", this one is "The Lords of the Dance", this picture is "Secretariat", we call that image is "E.T. On A Bicycle", this is "Fred Flintstone", that is "Michael Jackson," this is "The Last Supper". You can't say "it is a painting" or "it is a horse", it has a specific name you must memorize and cannot derive from the image itself. – Amadeus-Reinstate-Monica Jun 1 '17 at 16:37
• You've never seen a class of people struggle to memorize a bunch of new terms? And you think they retain those terms months or years later if they don't practice them regularly? I'm not saying it's impossible, but it will require many, many hours both to learn them initially and to keep the memory fresh. Those 15000 words everyone knows were mostly learned during a limited period when the brain is much better at learning words, and are also used on a regular basis. And what're you going to do while everyone is initially memorizing them? – Kat Jun 1 '17 at 22:19

There are a bunch of interesting answers already, but this is worldbuilding not riddle solving, so you are looking at this for a story or a game or something similar.

Which means you want that there is such a way and are fishing for ideas. Well, what does the rest of your story require? How difficult should it be? Where is the tension? Is the identification of shapeshifters equally difficult, or are the means readily available to the lord, but hard to acquire for the common folks?

The typical story-based solution is some allergy or unusual reaction to specific substances, typically ones that are not too common. Silver is a good choice in many stories because it is common enough to be encountered here and there, it is also rare enough that you don't typically have some with you when you travel in the woods.

Food is another common option (garlic, etc.) and for variety you can have your shapeshifters have a set of food allergies, so the same test does not completely reliably identify all of them, but one of the tests always works. The requirement of having to eat or drink a certain quantity (half a bottle, not just one sip) before the allergy shows up would prevent the town folks from simply giving everyone all the tests all the time.

There are all the other allergies, like sunlight, crosses, etc. that fiction invented. The thing is that this class of things that make the creature different from a human were invented for a reason - they work. They can be used in a story in different ways, they are flexible, they are not always reliable due to variations, etc. etc.

Another common solution in fiction is that even with perfection, there is one thing that gives the creature away, and that is what makes it what it is. In your case, it is shapeshifting. If there is a way to force a shapeshifter to shift, that way just became your way to identify shapeshifters. Again, your story requirements determine what that way is. It might be dangerous or harmful to ensure it is only used after an initial suspicion. It might be costly or difficult to execute for similar reasons.

But according to your initial assumption, the copy is perfect. If that is a strong requirement, then the only difference between original and copy is the ability to shapeshift and that has to be your token.

Indeed, you already included this solution with the week-long-fasting. But why are you making it so difficult and then ask for an alternative? Re-think that condition. Water is more important than food, and the involuntary shifting might be induced after a day without water instead of a week without food. Again, this is worldbuilding so the solution should be built according to the requirements of your story, not some arbitrary preconditions.

# Use a personalized password, and prepare for emergency lockdowns.

I actually support the idea of some sort of password - in this case, one unique to each person. Sure, it can be tortured out of them, but that's going to require some time. One does not simply walk into a town, kidnap someone, get the password from them, and then bring them back ten minutes later. It takes more time than that, generally.

If a person is kidnapped, it will be known that they've been kidnapped. The victim will likely know after the fact, unless they've suffered amnesia, so if they should be able to sound the alarm when they return - not that it would necessarily do much good. However, the person's loved ones will know when that person is kidnapped, and they can tell the town's leaders. To ensure that, though, it is imperative that everyone stays with someone else at all times. No traveling alone, in the town or out of the town.

Any kidnapping shuts the town down. Nobody outside is allowed back in, and if a person appears to be a known member of the town, they must be subjected to the intense quarantine required to prove that they are who they are. As you've said, attacks seem to be rare enough that such lockdowns should not be a regular issue.

I'll also note that redundancy is a virtue. There's no reason you couldn't have a method of identification and a password, for instance. An inventive person might secretly hide their ID somewhere outside the town; even if they're kidnapped and have to give up the password, they'd still know where the ID is.

• In a medieval setting, when it usually took several hours to go to the nearest village / another point of interest, someone traveling alone could very well be abducted without anyone knowing. – Keelhaul May 31 '17 at 14:34
• @Keelhaul That's true, which is why I suggested that nobody be allowed to travel alone, even outside the town. Heck, maybe even a military escort of a soldier or two could be given, if it's really needed, to small groups of travelers. – HDE 226868 May 31 '17 at 14:35
• Another flaw of the password idea is that it can't be used by everyone, unless everyone knows the password of everyone. A shapeshifter could also ask for the password of someone "just to be sure", then kill that person and use its password without even having to torture him. The only credible way to do it is to have a centralized checking in case of doubt... but then it doesn't protect anyone and could still be compromised. – Keelhaul May 31 '17 at 14:38
• @Keelhaul Note that I said that each person should have a unique password, known only to themselves and whatever system checks the passwords upon entry. – HDE 226868 May 31 '17 at 14:39
• So that's the centralized checking I evoked, which only consists of a verification in case of doubt mechanism, and can still be rendered useless if the shapeshifter took some time to torture the guy. (BTW, I love how our avatars match :p) – Keelhaul May 31 '17 at 14:47

If the town is small enough you could have a distributed trust system, where you would have an identifying password with multiple people in town that is unique to that person.
It might even be a common greeting, like greeting each person with a pet name that is unique to the relationship between the two of you.
So I might call you Tiny, and Bob might call you Slim, and so on.
And so if I came up to you and didn't greet you with the correct greeting then that would be a red flag.
So you'd be justified in calling me out on it and getting a few other people with weapons to see if I know my nicknames for them.

The changelings can probably torture a few passwords, but several hundred?
Especially if I can also give some fakes out to trip them up?
Much less likely.

Implement random imprisonment policy. Periodically, a random sample of people are imprisoned for a couple of weeks without food. The size of the sample depends on how many people you can take out of the society without significant impact. This will not guarantee that you weed out all shapeshifters, but forces them to take the chance.

Additionally, whenever someone raises the suspicion that someone else is a shapeshifter, imprison the latter and keep an eye on the former. If the latter doesn't turn out to be a shapeshifter, imprisoned the former.

Alternatively, if you have some substance that speeds the process, cut something like hair and see if it shifts back.

As for personalized passwords - they are still applicable. Whenever someone is tortured, he can just give the reptilians a wrong password. They have no way to know if he is telling the truth other than use said password. If the password is wrong, the shapeshifter will die as well. Further torturing the person after this point is pointless. People will not believe a second John is John if they already captured and killed a shapeshifter that impersonated John.

Same one humanity has always used for this purpose:

The amount of religions in the world with vast number of differences is absurd, and how often they ignore fairly obvious things about reality (like a religion that believes in a flat earth when we can fairly regularly see the shadow of the Earth on the moon). There's tendency to show that tendency towards religiousness is genetic, and the genetic advantage of it is obvious:

Easy friend-foe recognition. As tribes became larger so you didn't know anyone by face, spies from opposing tribes could regularly be rooted out by them not following traditions, not knowing mantras, etc. Religions are -heavily- ingrained into societies, and often have a lot of nuance; and due to holidays, expected activity can shift radically in a single day. And religions have a tendency to quickly build up regional variations in larger society.

It's not pretty, it's not friendly, but that's what humanity has throughout most of its evolutionary history used as friend-foe recognitition in lieu of familiar faces (and why we have such a problem with religious fighting and/or intolerance to this day. Literally ingrained into our DNA is the desire to be picky about religion as a survival mechanism.)

• And regional variations play a huge part. Sure, if it's set in European medieval, they can probably just grab a bible and try to use that as their basis...but, for example, if they're in a coastal town and start refusing to eat crab as a result of reading Leviticus, it's going to out them. There's so many things in a region's traditions and religions that it's almost impossible to fake it if you weren't raised there. – liljoshu Jun 1 '17 at 17:46
• Simple example of how this can be used intentionally: The Lord of the keep calls for a mandatory chapel meeting for the whole region to celebrate X (be it a new heir born, a half-century celebration of the current reign, or a "special service" to pray for blessing and safety against the shape-shifter threat.) Then, everyone shows up... guards in groups sweep through region during service and kill anyone who didn't show up. Then during the service, everyone is invited to sing the town's favorite hymn... Guards planted in the audience kill those who obviously don't know the words. Done. – liljoshu Jun 1 '17 at 17:53
• The term for this kind of thing is shibboleth: en.wikipedia.org/wiki/Shibboleth – jhocking Jun 1 '17 at 18:22

There have been some great answers already, but few would really be applicable to a traveller and usually require a tabulation of prior knowledge about a person. The shifters may appear physically identical, but that may not carry over to their bodily's autonomous functions. Reaction time and sleep requirements may be significantly different for a shifter, maybe they don't sweat when they're nervous (or at all), their body hair doesn't stand up when cold, they don't shiver or have a gag reflex. Perhaps their skin flushes in strange ways when they're hot or they can't eat certain foods (though anything that requires resources to administer might be too much for a small town). If you want some comic relief you could even oust people for a sudden lack (or feigned gain) of libido.

These could all be tested fairly easily once a shifter has already been detained and even give a little leeway for a couple of shifters to make it through the tests and cause mischief if required for the plot.

In the center of the town, place a huge bank of strongboxes. There is a box for each person, with their name written on it. The boxes are locked, and the named person has the key to their box. In the box is a paper with a password written on it.

To prove your identity, you must do three things:

1. Look like the person you are claiming to be.

2. Be able to open that person's box.

3. Know what is in that box.

The process is simple. You go to the boxes, announce your name and the password, then give the key to an official who opens the box and verifies the password. Then you put a new (secret) password in the box, lock it, and you're done.

This can also incorporate theinvisibleduck's suggestion of a "trap" password. You write two passwords every time: one means "it's me", the other means "it's not me, I'm an imposter stab me in the kidney". Once again, replace both passwords every time.

• Story complications that result: Any shape-shifter who has already infiltrated would remain permanently infiltrated since they'd know passwords. And if they ever got into position of controlling the passwords in the lockboxes... – liljoshu Jun 1 '17 at 17:58

I did notice at least one person mentioned Leeches, and Blood, and a lot of people recommend Fire or cutting of Hair, but what if their Hair is a hazard to their Profession? (eg. Blacksmith, they work around Fire all day, they don't have any desire to catch their Head/Face on Fire, they Shave Both).

One person mentioned Dogs, except we are forgetting in that aspect that we are dealing with something that can easily change it's shape, thus allowing it to not only have the advantage of being more intelligent than the Dogs and their Owners, but it could also easily Overpower even the most ferocious of Wolves, as it could simply transform into a Jaguar and easily take out 5 Dogs without issue, at which point it could simply gather 5 other Shapeshifters and now there's a Pack of "Dogs" roaming the Town desiring to cause Chaos in any forms they can manage, such as alerting the Townspeople that their beloved Mayor is a Shapeshifter all of a sudden. Gee I wonder when that happened? Answer: it never did happen, the Shapeshifters learned the Dog's behavior once the Dog reacted to it, and then spread that information to it's "Pack", and because there's so many of them, the Dogs wouldn't dare approach, as even animals such as Dogs know when they're out numbered (think: Han Solo chasing Storm Troopers into their Ambush where he promptly Flees).

• My suggestion was to start with Leeches to induce Bleeding as they produce an Anticoagulant, then comparing the Blood Color (which would most likely be Red due to the Shapeshifter's studies of Humans).

Note, the Bold items in the above Paragraph are all potential differentials, meaning they could all possibly have a different reaction between Humans and Shapeshifters, and would need to be documented.

• The next testing would be to compare certain effects such as Fire (used in The Thing to Combat The Thing as it couldn't withstand Extremely High temperatures for very long and would suffer from Cellular Break Down, but they didn't just randomly start burning people, they had a Test, if the Glass Shattered, they were Infected, and THEN they were killed, but not before the Truth was revealed, this question is asking to provide a New Test besides Starvation).

• The next Effect would be Ice, which was easily accessible in the Medieval Era as they had a good Knowledge of Permafrost locations and kept ample storage of Ice in the local Ice Sheds for Refrigeration of their Food supplies, the Ice would also be readily available from the various Traders, because it's an in-demand resource no matter what Town they Travel to (unless it's an Exporter of Ice, at which point the Traders would Stock up, both for Resale and for Personal Storage)

The Ice would be compared to both the Blood Sample and the Individual in question (Nerve Reflex? Shivering? Shuddering? Reflexive Reaction? {the "EEK!" factor} etc.)

• The next test would actually be quite a bit more pleasant to Test, to a certain extent: Toxins! Beginning with Fermented Grains (Ales/Beers), then Fermented Berries (Wines). I'm sure that quite a few citizens would know each other's Drinking Habits, seeing as it's the most common Disinfectant available, and it's got quite the large Recreational use amongst the population ("Bob, you're such a Lightweight! only 2 Pints?! this is my 7th! Bwahahaha!" one day, Bob suddenly can drink 10 Pints and is barely Bubbly Something is amiss...)

• The reason I said toxins would be somewhat pleasant is the next Test, Allergies! Quite a few humans have very common Allergies (Poison Ivy, Poison Oak, certain Mushrooms are even Lethal, etc.) but some aren't allergic to the common Allergies, whilst others are Allergic to almost everything they can think of (Dust, Pollen, various Cloths and Animals, I for example have an Allergic Skin Reaction to Pigs, but a Shapeshifter wouldn't realize that until the Rancher had already gathered a Militia).

• There's also the power of Misinformation, one could convince every towns-person that they've been branded with their own unique number, and they are even able to know the Number, but instead of Branding everyone, you simply Heat the Metal, so as to feel hot, but not hot enough to actually Scar them like is preformed in Branding.

The same sample comparisons (eg. Fire, Ice, Toxins, etc.) could also be preformed upon any Hair Samples that can be acquired.

I hope I have created a rather comprehensive gauntlet of tests and that potentially at least one of these becomes highly successful for the Townspeople, as these Shapeshifters they're dealing with are giving the peaceful varieties a bad reputation.

Edit: a few other Posts reminded me of the Tactic used by a few rather intelligent Villages that were once under siege by a mythical being of some type or another (and in one instance: the Dhampir known as Blade, the Vampire Hunter) where they Laced the Food and Drinks with a Toxic Substance that didn't affect the regulars. (Blade isn't affected by Holy Water, it's even in his Tap Water, there's also stories of Silver in Water Supplies to ward off Vampires as that would make every house a place containing a Water that "burns" {like Holy Water} the Vampires, and also prevent them from "blending in")

In an episode Star Trek: DS9, Changlings have infiltrated Earth. In response, the security services take blood samples from everyone. If it was a from Changling then it revert to Changling's silver liquid form after a few seconds.

Your town's inhabitants could do they same, and terminate with extreme prejudice anyone who fails. However, it is possible that the blood sample is held by another shape-shifter then it will stay looking like blood.

Because of the law of conservation of mass, shapeshifters cannot change their weight. I would recomend:

1. making sure that noone in the village is a shifter (the hunger test doesn't have to be done at the same time for all the villagers, so a part of them can always work) and
2. everyday weighting all of the villagers. Their weight cannot change too much in a one day, so any big differences between weightings would give the shapeshifter away.

You could also just ask a lot of questions and observe the behavior carefully. It's actually much more safe option than a password - remembering all the things that one person should know is much more difficult than remembering a word or two. Shifties could observe that John Smith is hard-working and his wife is named Mary, but they don't know his whole history, which will be painfully obvious after closer examination.

Even a dumbass will know that something is wrong if "John" will hesitate to state the name of his dead blacksmithing master, whom he bragged about that much last summer - and report it to the authorities.

Boom, hunger test.

His wife for sure will see that he shouldn't be so enthusiastic about spinach or that he suddenly doesn't need coffee. And, of course, shapeshifters could not do any job requiring a lot of experience that they don't have - so specialists (or just people knowing a bit about their jobs) would be safe.

The experience part also helps you in checking the guests - specialists who can do their job well are nearly for sure humans, non-specialists can just take some personal history tests ("What was your favourite childhood toy?" - good answers: "A doll" "Does a broom count?", bad answers: "Eeeeeee... ball?" "A sword" - told by a guy claiming to be a normal peasant; and a lot more of these).

Seriously, this shapeshifter couldn't think every detail through, couldn't know everything about local customs, and it will be seen. Also, as said before, fake questions. This would be easy as pie in a small, closed rural town, where everywhere knows dach other.

• "Because of the law of conservation of mass, shapeshifters cannot change their weight." Aside from the distinction between weight and mass, we have, right here on Worldbuilding, determined that shapeshifters can change their mass. Some of those solutions even work with real-world physics; while they need a bunch of handwaving, they don't really require altering the laws of physics and thermodynamics. (Shapeshifters themselves is another matter...) – a CVn Sep 21 '17 at 20:54
• Welcome to WorldBuilding! Interesting answer. You should try to use markdown (for example two linebreaks for one paragraph) to make your text easier to read. If you have a moment please take the tour and visit the help center to learn more about the site. Have fun! – Sec SE - clear Monica's name Sep 22 '17 at 7:35
• Also: Why should I register my account? By registering you have easier access to your posts and can keep favourites for example. You will also be able to collect reputation and unlock new privileges, such as voting and commenting on other peoples posts and posting on Meta and coming to the chat and quite a lot of other features. Currently all your progress will be lost once you delete your cookies. I hope you stick around! – Sec SE - clear Monica's name Sep 22 '17 at 7:36

For what it's worth, I just read a book (Faded Steel Heat, by Glen Cook) where shapeshifters were involved and identifying them was crucial.

In that case, the shapeshifters had a bad reaction when touching silver (think werewolves and vampires and such).

If your shapeshifters had what amounted to an allergic reaction of some sort to some relatively common substance (iron, vanilla, dandelion fluff, whatever), then it would be easy to identify potential shapeshifters; the longer term methods to confirm identity (fasting) could be applied. It would royally suck to not be a shapeshifter and have that same allergy, but it would be survivable; stick around home, and use the "buddy" system so that one or more people without the allergy never let you our of their sight, and you might even be able to live an almost normal life.

Yes, this does involve something not accounted for in the original question, and isn't necessarily as elegant as the "have the shapeshifters not be able to match a human scent, thus being detectable by smell" (and in fact, that was used in the story I just read as well; shapeshifters didn't smell like humans, and could be tracked that way), but it could make for some interesting twists on the economy of your world (whatever shifters were allergic to would tend to be somewhat valuable, because it would be in everything - buildings, clothes, maybe food, etc), and could make for some interesting moments ("What do you mean he burned down the dandelion patch!?")

Why not simply have the shapeshifter smell a little different to humans?
Not pungent, but just enough that a careful close-up sniffing reveals that they are different to humans - especially humans with medieval hygiene.

A simple method would be to use long-range light based semaphores (the semaphores would be a sealed system, with only quarantined access) that send a piece of identifiable information that the individual should know.

The information is sent by a 3rd party via the semaphore using a shifting cypher known only to the individuals within the semaphore towers. This information would be sent by one who knows the person, but has not informed them what information they are sending.

This system would also setup the background to which the tales of the elves would be able to come in (stealing babies and replacing them) as then they would have 'inside men' growing up knowing the others in their village/town.

It also allows for the very serious problem of what happens to loners and outcasts.

This sounds like a game of Werewolf only without someone in the Seer role.

As such, you could have regular accusation sessions, and watch for the differences in psychology at work. People are slower when lying or having to invent answers, than they are with telling the truth, so a simple "Raise your hand if you're townsfolk" gives you a nice starting point. The longer it goes on, the ones with secrets get more and more impatient.

You could see damage limitation strategies appearing, too. Redundancy through separation - it's much harder for an infiltrator to damage the food supply if you have many small grain stores, and it's harder to sabotage weapons or steal jewels if they're kept split up in several places.

If only a small number of people had access to barn number 6 and something happened there, it increases the chances of you discovering the shapeshifter. This also makes it easier to use a honeypot or some other form of tempting target to ensnare infiltrators or encourage them to perform hasty actions.

Take a pistol Blade and point it at the suspected doppelganger. Calmly but firmly threaten it with death unless it shows itself. Then wing it. If you wound it and it still acts like a person then you're nuts and there was no shape shifter. Discretion won't win the day here, you have to be almost recklessly decisive.

Edit: P. S. It is also helpful to offer an Edit to assist them further. But that is still accurate, Violence wouldn't solve anything long term and would only cause distrust amongst the population we are trying to keep safe. Still a very good first try.

• Welcome to Worldbuilding, Saila, I'm not sure threats are a good way to unmask shapeshifters, Unfortunately, pistols aren't very medieval. I suspect cunning shapeshifters would continue acting like persons. You can improve your answer by explaining how threats can identify shapeshifters. A good first try. Have fun here! – a4android Jun 4 '17 at 6:19
• @Blue64 I'm not sure it's a good idea to go around editing your own suggestions into other people's answers. If you have a comment, put it in a comment. – F1Krazy Jun 9 '17 at 9:35

There's a fairly simple way to solve this. Each person leaving the town deposits a token of some sort. After they have left, the token is given an ID and the ID is written next to their name. The token must be an everyday object and all tokens must be of the same type. The token must be sufficiently familiar to be able to be identified on return, while being sufficiently similar to all the others to be almost impossible to describe such that someone else could identify it from the description. When you return, you idnetify your token, and give the guard the ID and your name. If they match you enter, if not, you sit in a cell for a week. Tokens could be a piece of wood, or a lumpy stone where you would be able to remember something about the grain or the lumps, though here you would need to make sure people trained in remembering their token. What's important is that the token is easily identifiable, but in ways that are almost impossible to communicate. For added security, you could multiply the number of tokens required.

Give 'em a haircut

If the shapeshifters turn grey and gooey soon after death or after fasting, what happens to their hair after it's cut ?

So getting a haircut becomes a regular community event, they make a party out of it. Maybe a weekly get together. The hair is stored in jars with each persons name on it and the jars are kept locked and guarded. The jars are inspected twice a day by the town barber / sheriff and anyone who's hair has gone gooey gets a rather more violent and permanent haircut very shortly afterwards.

If someone's bald, give them a manicure.