Document Verification & NFC e-Chip Reading (eMRTD / ICAO 9303)

How modern ID documents are verified using optical checks, NFC chip reading, and PKI validation per ICAO Doc 9303.

Overview

Modern passports and many IDs are electronic Machine-Readable Travel Documents (eMRTDs) with an NFC chip. Verifying them combines visual checks with chip reading and PKI cryptographic validation to confirm authenticity and detect tampering.

How it works

  1. Optical checks: MRZ, VIZ, security features.
  2. Secure messaging: Use MRZ or CAN to start BAC/PACE.
  3. Chip read: Extract LDS data groups (e.g., DG2 face, DG1 MRZ) and SOD.
  4. PKI validation: Verify SOD signature using issuer’s DSC/CSCA; trust roots often fetched via the ICAO PKD.
  5. Consistency checks: Compare chip data vs printed data; run face match to selfie if needed.

Common use cases

  • Border control; eGate flows
  • Remote KYC / onboarding (NFC on smartphones)
  • Airport or workplace issuance/verification

Strengths and limitations

Strengths: Cryptographic authenticity, global standards, offline verification with cached trust lists.
Limitations: Access to trust anchors; device NFC variability; privacy rules on biometric access.

Key terms

  • LDS (Logical Data Structure): Standardized layout of chip data (DG1..DG16 + SOD).
  • PKD: Global repository of signing keys and revocation material.

References

Vendors using Document Verification & NFC e-Chip Reading (eMRTD / ICAO 9303)

Latest Data Cards

  • Data Card

    BoyleSports selects Jumio for player identity verification

    2026-07-13CC-BY-4.0document-verification-nfcfacial-recognitionpadjumio

    BoyleSports selected Jumio Identity Verification and Doc Proof to automate player onboarding and compliance checks across the UK and Ireland.

    • The deployment combines identity verification, document checks, biometric screening, and automated AML screening.
    • The workflow supports compliance with Ireland's new Gambling Regulatory Authority requirements.
    • BoyleSports reported higher automatic verification rates and less manual review after deployment.
  • Data Card

    Uber scales Apple Wallet digital ID verification across its identity platform

    2026-06-24CC-BY-4.0digital-idmobile-iddocument-verification-nfc

    Uber integrated Apple's Verify with Wallet into its cross-app identity verification platform, using mobile IDs and ISO/IEC 18013-5 checks to support reusable verification flows.

    • Uber built Verify with Wallet as a reusable identity platform capability across Uber, Uber Eats, and Postmates rather than as isolated product integrations.
    • The integration validates mobile document payloads against ISO/IEC 18013-5, including issuer certificate and device-origin checks.
    • Uber scopes identity attribute requests by use case, such as driver onboarding, age-gated orders, or car rental workflows.
  • Data Card

    FMCSA launches Motus platform with IDEMIA identity verification and Login.gov integration

    2026-05-14CC-BY-4.0digital-iddocument-verification-nfcidemia

    The Federal Motor Carrier Safety Administration replaced legacy registration systems with Motus, a USDOT registration platform that includes IDEMIA identity verification and Login.gov account linkage.

    • Motus replaces FMCSA's legacy Unified Registration System and certain portal features.
    • FMCSA described IDEMIA's role as adding stronger identity-verification protocols, data validation, and secure account-management features.
    • Existing and new registrants must complete identity verification when accessing Motus after activation.

Frequently Asked Questions

What’s in the chip?
The LDS stores data groups (e.g., DG1 MRZ, DG2 face image, DG3 fingerprints, DG4 iris) plus the SOD file containing signed hashes.
How do inspectors validate authenticity?
They verify the SOD’s signature against trusted CSCA/DSC certificates (often via the ICAO PKD) and ensure DG digests match the chip contents.
Which access protocols are used?
BAC or PACE establish secure messaging; AA/CA/EAC provide stronger document authenticity and biometric access controls where applicable.