NFC e-passport verification guide

NFC chips are one of the most widely-used pieces of technology in the world. They’re so widespread that you probably use the technology at least once a day — any time you tap to pay with your phone or debit card, or scan your passport while traveling.

But did you know that NFC chips can also be incorporated into your identity verification processes? Specifically, they can be leveraged to add an additional layer of security and protection in passport verification.

Below, we define NFC technology and take a closer look at how NFC chips work. We also explore the role that the technology can play in your identity verification processes.

What is NFC technology, and how does it work?

An NFC (near-field communication) chip can best be thought of as a cross between a computer chip and an antenna that is capable of communicating with nearby devices. 

The chip stores information, while the antenna serves to establish a connection with the nearby NFC-enabled device. Examples of such a device might include a smartphone, payment terminal, or other type of NFC scanner.

Once a connection has been established and any security requirements have been met, the chip will grant the device access to whatever information is stored in its files. 

NFC technology and e-passport verifications

While NFC chips are most commonly associated with credit cards and debit cards, they are also included in certain modern forms of ID. This includes many passports — which are commonly called e-passports when they include an NFC chip — as well as ID cards from certain countries in the EU.

With this in mind, businesses that accept passports as a form of government ID during their identity verification processes can potentially leverage NFC verifications to easily identify forged documents and decrease instances of passport fraud. For this reason, NFC verifications are sometimes called e-passport verifications.

Generally speaking, in order to leverage NFC verifications as a part of your IDV workflow, your business needs to meet the following requirements: 

• Your business accepts passports as a form of government ID

• Your identity verification or eKYC processes can be completed via a smartphone app or on a website that can be accessed using a modern smartphone

‍

Why are NFC e-passport verifications useful?

Many government-issued IDs contain a variety of visual security features that make it more difficult for a bad actor to successfully forge the document. Most US driver’s licenses, for example, as well as passport cards, include a barcode (and other cues) that are difficult to duplicate. 

Passports, on the other hand, have very few visual security features. This means it’s usually easier for skilled bad actors to forge passports than other forms of government IDs. A well-made fraudulent passport can even evade manual review by the human eye. 

This opens up businesses that accept passports as a form of government ID to the risk of hard-to-detect passport fraud.

Because NFC chips are so difficult to forge, implementing NFC e-passport verification as a part of your IDV processes addresses this challenge by adding an additional layer of security that would otherwise be missing from the equation. 

How do NFC e-passport verifications work?

The easiest way to understand how NFC e-passport verifications work is to walk through an example:

1. The user begins the identity verification process.

Naturally, it all starts when a user begins the identity verification process on their mobile device — either through a smartphone application or through a website accessible on a mobile device.

2. Passive device signals indicate whether or not the device is NFC-enabled.

As the individual goes through the verification process, passive signals from their device are collected in the background. This includes a variety of information, such as the user's IP address, geolocation data, and device fingerprint. Most importantly for the purposes of NFC verification, it also includes whether the device is capable of reading and interacting with NFC chips. 

As a note, all iPhones since 2014 have built-in NFC readers. Samsung has included NFC capabilities in many of its smartphones since 2015, but still produces some budget devices that are not NFC enabled. Likewise, budget Android devices produced by other manufacturers may not include NFC readers. 

If the device is NFC-enabled, then NFC verification can take place — and if the functionality is turned off, the system can recognize this fact and guide the user through the process of turning it on.  On the other hand, if the device is not NFC enabled, standard passport verification must suffice.

3. The user chooses to use their passport as proof of identity.

In order to leverage NFC verification, the user must opt to use their passport as their proof of identity. If they select a different option, such as a driver’s license or ID card without NFC technology, NFC verifications will not be relevant. 

4. The user is prompted to take a photo of their passport.

The user is then usually prompted to take a photo of their passport. This photo will be analyzed to ensure that it is of acceptable quality. This includes ensuring the photo is well-lit, not blurry, and doesn’t include any glares or other issues potentially rendering the photo unusable. 

5. The system automatically extracts key information from this photo.

If the photo is deemed to be acceptable, the system automatically extracts key information from the document. This includes the individual’s passport number, date of birth, and expiration date. The user is asked to verify that this information is correct; if there are any errors, they are asked to correct them. 

6. The user is prompted to scan their passport’s NFC chip.

Once the extracted information is verified by the user, they are then asked to scan their passport’s NFC chip. To do this, they must place their phone in close proximity to the chip, which is typically located in the back cover of the passport. 

In order to access the information stored within the chip, the device must provide the NFC chip with certain pieces of information that essentially act as an encryption key of sorts. This includes the individual’s passport number, extracted in step 5 (above). This happens automatically, without the user needing to take any action.

7. The device downloads relevant information. 

Having gained access to the chip, the device is allowed to download information relevant to verification. This includes the passport holder’s:

• Name

• Date of birth

• Place of birth

• Date of issuance

• Expiration date

• Biometric identifier (typically, a photo)

Using this information, the passport is verified and other identity verification steps can proceed. Generally speaking, all of these steps usually take less than 60 seconds to complete. 

What are the benefits of leveraging NFC verification for passports?

The primary reason a business might choose to implement NFC e-passport verifications is that they want to reduce the risk or incidence of passport fraud. 

While it’s difficult to do so, it is possible for a skilled bad actor to forge a passport using Photoshop and other tools. It’s much more difficult to forge an NFC chip and the data stored within it. Including NFC verification as a part of your e-passport verification processes can add an extra layer of security and defense against forged documents. 

Other benefits of NFC verification for passport verification include:

• It’s highly secure: NFC e-passport verification is much more secure than regular passport verification. This is due to the added layer of security provided by the NFC chip, which is incredibly difficult to forge. 

• It’s highly scalable: If your business manually reviews passports submitted during the IDV process, scalability is probably a major concern for you. NFC verification can dramatically reduce, if not eliminate, the need for a manual review of passports. 

• The technology is widespread: All iPhones since 2014 and many (though not all) Samsung phones since 2015 include NFC readers. Meanwhile, the United States Department of State has exclusively issued e-passports since 2006. This means that all US passports currently in circulation should include an NFC chip. 

• It’s easy to implement: Depending on the verification tool(s) you use, it should be relatively simple to implement NFC verifications, so long as you already perform verifications via mobile integration. In most cases, it’s just a matter of toggling on the option. Persona makes it easy to get set up with new types of verification like NFC.

What are the challenges?

Of course, as with all other technologies, NFC verification does not come without potential challenges. 

On one hand, while most modern smartphones are NFC-enabled out of the box, there are still some devices that cannot read or interact with the chips. This includes older devices, as well as some budget devices. With this in mind, it is unlikely that 100% of all passport verifications can incorporate NFC verification — at least for now. 

As such, your IDV processes need to be flexible enough to account for different user device types — offering one path for users with NFC-enabled devices, and a different path for those without NFC capabilities. Without this flexibility, users who don’t have an NFC-enabled device could drop off without converting.

Additionally, there is always the potential for user error. If the user does not know where their NFC chip is located in their passport (or where in their device the reader is located) they may have difficulty establishing a connection. Likewise, if the user moves the device after a connection has been established (but before the files have been extracted) it can disrupt the process and force the user to start all over again. 

Fortunately, much of this confusion can be avoided through user education and on-screen messaging or prompts that guide the user through the process of scanning the NFC chip. For example, Persona provides users with contextual instructions and error messaging to guide users through the process and reduce the risk of drop-offs or confusion. 

NFC e-passport verifications and your business

NFC verifications can be leveraged to reduce the risk of passport fraud anywhere you might require a user to provide a government ID for verification. While most commonly leveraged during account opening and client onboarding, it can also be used as a part of the reverification process.

Here at Persona, our Verifications solution offers NFC verifications out of the box. Of course, we recognize the fact that no two users are exactly the same; each user and each transaction carries its own unique level of risk. Leverage our Workflows and Dynamic Flow solutions to build the verification process that makes sense for your business, whether that includes NFC verifications, document verification, selfie verification, database verification, and more.

Interested in learning more? Start for free or get a demo today.