NFC verification explained: secure and seamless document verification

By 2024, an estimated 1.6 billion devices will be enabled with Near Field Communication (NFC). And for the estimated 20+% people globally that have NFC access today, usage has become so intuitive that most won’t realize this technology is unlocking their everyday experiences; from passing border control at international airports, to enabling everyday transactions like paying for groceries, and now, enabling secure and seamless identity document verification.

What is NFC?

Near Field Communication was coined in the mid 2000s and is often used synonymously with the term ‘contactless.’ It is a method of wireless data transfer that allows smartphones, laptops, tablets, and other devices to share data when in close proximity (a few centimeters). As more smartphones become NFC-enabled, it is giving millions of consumers the ability to make frictionless contactless transactions. Adoption of NFC is widely expected to accelerate and digitally transform a multitude of new use cases that require identity verification; from unlocking cars, subscriptions to unique brand experiences, and hotel check ins.

The radio-frequency identification (RFID) chip found in many secure identity documents was originally designed for use with purpose-built passport scanners. But they can also communicate with NFC-enabled phones, making NFC a valuable tool for remote identity verification.

How can NFC chips be used to verify identity?

According to the ICAO, there are 140 states and non-state entities (such as EU and UN) offering NFC-enabled biometric passports, as well as biometric national identity cards and residence permits with NFC capabilities. This allows the documents to simply be tapped against an airport eGate or NFC-enabled smartphones to extract their data and cryptographically verify it. NFC is very attractive as a form of document verification (and by extension, identity verification) because it’s very secure. The chip contains the same biometric data found on the document, including a digital, higher resolution version of the same photo.

This means you get an accurate comparison with a selfie or video of the holder, offering further protection against photo-substitution. Because the data is securely read from the chip, you can check it using public keys or for special anti-cloning features. This ensures high-quality data, which in turn reduces False Acceptance Rates (FAR).

And it only takes seconds to read the chip, so there’s less friction for the end user, creating a better onboarding process for them.

How does NFC verification work?

There are two stages to the NFC verification process:

1.  Secure Data Extraction from the NFC chip:

• NFC Passports rely on Basic Access Control (BAC) to protect access to the information contained in the document. It requires three data points present on the Machine Readable Zone (MRZ) lines, found at the bottom of the document, to access the NFC data. When a user verifies their identity with an NFC-enabled document with Onfido, we automatically extract this data from the document image — there’s no additional action required from the user, resulting in a seamless experience.
• Most NFC national ID cards & residence permits rely on PACE (Password Authenticated Connection Establishment) that relies on a 6 digit code printed on the front of the document to access the NFC data.

Both methods prevent anyone from lifting data without the holder’s consent or knowledge.

2. Cryptographic validation of NFC data:

• Passive Authentication verifies that the data on the chip has not been altered since it was issued, by validating each data element’s cryptographic signature using the issuing country’s public keys. In turn, these public keys are actively maintained.
• Active Authentication verifies if the NFC chip itself is authentic (not cloned) by generating a dynamic challenge to the card that is validated.

How does Onfido use NFC verification?