To play "devil's advocate", I would take a C&R from someone face to face and compare his photo ID with his appearance and the name and address on his C&R. Through the mail, and with no way to check the address on the C&R with the ATF website, I might suspect a homemade C&R copy. I have no idea why ATF does not allow verification of the C&R on their website. After all, the C&R is a licence, just a different class of license from a dealer's license.