Seems like every year somebody gets caught in State Cup. Most of the time, it is probably negligence on the part of a team's registrar. The registrar doesn't check the paperwork, takes the parent's word that the player was born on a certain day or year, and casually inputs the information into Calsouth's CORIS system. Bingo, the player is in. Calsouth does not require the registrar to scan a copy of the birth certificate or passport into its registration system, although there is a place to do it voluntarily. If Calsouth required a copy of the birth certificate or passport to be scanned into the system, it would cut down the cheating dramatically, and create a paper trail to prove where cheating exists.
For clubs which carefully check birth certificates and/or passports, even if they are copies and not originals, cheating must be very rare. For a family to cheat, they would either have to supply a false birth certificate for their child, such as the birth certificate of a friend or cousin, or alter the document provided. I'm sure this has happened on a couple of occasions, but it must be very, very rare. And when it is done, I'm sure the parent finds a way of rationalizing. (She should be able to play with her friends; her birthday is so near the cut-off anyway; she is small for her age ... .)
The problem with this type of cheating is that it is so easy to get caught. Players know each other from school and other events, and they know what each others' real names and birthdays are. They mention it to their parents. Parents mention it to the coaches. And coaches will sometimes rat them out. The risk of this happening in State Cup is much higher than during the season, because the stakes are perceived to be higher.