ATHENS—Mystery deepened over a Paris attacker who traveled to Europe via Greece and the Balkans, after French officials said Monday that the Syrian passport he had used was indeed a fake.

Authorities in France and Greece have said that fingerprints taken from the remains of a suicide bomber outside France’s national sports stadium, the Stade de France, match the prints of a man who entered Europe via the Aegean island of Leros on Oct. 3.

Police on Leros registered the man under the identity in the passport he showed them: Ahmad AlMohammad, 25, from Syria. The same passport was found near the man’s body outside the stadium on Friday night.

Whoever the man was, he posed as one of the many refugees fleeing Syria’s war—including the violence of Islamic State—to enter Europe through its lightly controlled frontier in the Aegean Sea.

Greek authorities on islands such as Leros, Lesbos and Chios have confronted thousands of arrivals every day in recent months as refugees and other migrants make the short sea crossing from Turkey in inflatable boats. Short of staff and equipment, Greek police carry out only a simple procedure that involves taking people’s data and fingerprints, and sometimes asking them a few questions, before giving them permission to travel onward, deeper into Europe.