Why NFC Identity Verification Is the Best Thing for Regulated Industries

Near-field communication, or NFC, is a wireless technology that allows devices to exchange data over a short distance, typically a few centimeters. In identity verification, it connects a document’s chip with a reader, such as a compatible smartphone.

NFC is based on radio frequency identification (RFID) technology. RFID is a broader term covering systems with different operating ranges. The contactless chips used in electronic passports and many national ID cards work at close range and can communicate with NFC-enabled smartphones.

Electronic identity documents, or eIDs, contain a chip that stores the holder’s personal data. Those with a compatible contactless chip can be read using NFC. Examples include electronic passports, national ID cards, and some driver’s licenses.

The chip adds a layer of security to the physical document. In electronic passports, its data structure and security mechanisms follow ICAO Doc 9303, the international standard for machine-readable travel documents. Digital signatures allow verification software to confirm who issued the chip data and whether it has been altered.

For businesses, eID verification is a useful option for remote customer onboarding. Some accept them alongside conventional documents, while others accept eIDs only to enhance their Know Your Customer (KYC) frameworks.

For regulated businesses, such as banks and fintechs, NFC can strengthen the document-verification stage of customer due diligence. 

There are at least three scenarios of how businesses can incorporate NFC into onboarding:

• NFC verification is mandatory. Customers need a supported electronic document to complete the onboarding process. This gives the business access to chip-based authenticity checks for every applicant using that route

• NFC verification is an additional check for expanded access. A business can ask customers to complete NFC verification before granting higher transaction limits or access to additional services

• NFC verification is one of several verification options. Customers with supported eIDs use NFC, while those with other documents follow an alternative process, such as video verification

For instance, UBS made submitting eIDs mandatory for all new clients opening a bank account.

The trickiest part of online identity verification is making sure that a user presents a physical document. NFC verification adds cryptographic evidence to document checks. A convincing fake passport image may reproduce visible details, but it cannot provide authentic chip data signed by the issuing authority.

Several RFID checks help establish that trust:

• Data authenticity and integrity. Passive Authentication checks the digital signature using the public keys of the issuing state and CSCA certificates that sign the DS (digital signature) Certificate, and verifies that the signed chip data hasn’t been altered

• Protection against chip cloning. Where supported, Active Authentication uses a cryptographic challenge-response to prove that the chip has its unique private key, or Chip Authentication verifies a chip-specific private key and establishes a secure communication channel, and the evidence that the chip itself is genuine. 

• Consistency across the document. Comparing chip data with the printed personal data, machine-readable zone, and barcode can reveal discrepancies, such as discrepancies in identity data or a substituted portrait

A successful chip check still needs to be linked to the person presenting the document. Comparing the chip portrait with a live selfie helps establish that connection.

The verification result itself also needs protection. If a system relies entirely on a result returned by the customer’s phone, a compromised device could report that a failed check passed. With Regula’s “zero trust to mobile” approach, the phone captures the chip data while the server participates in the verification process and independently verifies the captured session. This reduces reliance on results reported by the customer’s device and helps detect attempts to manipulate them.

NFC is widely available on smartphones, so many customers can read their electronic documents with a device they already own. They need no separate reader and can complete supported verification flows without visiting a branch.

The chip supplies personal details, such as the holder’s name, date of birth, and document number. These can automatically fill in application forms, reducing manual entry and typing errors.

Unlike physical documents, data stored on the chip does not fade with wear. It’s protected by the issuing authority’s digital signature, whose trustworthiness can be checked using certificates and certificate revocation lists (CRLs). These lists identify revoked certificates, for example, because the associated signing key was compromised.

The chip also provides a digital image without the loss of quality that can occur when photographing a printed portrait. 

Last but not least, NFC chip verification combined with biometric checks effectively supports a self-service process outside the hours when video calls are available.

NFC verification depends on the customer having a supported electronic document and a compatible device. Access to chip data also varies by document, so a successful read doesn’t necessarily provide all the fields a business needs.

• Electronic document coverage. Some countries, such as South Africa,  still rely on non-biometric passports. Also, even where eIDs are issued, valid older documents without chips may remain in circulation. An NFC-only onboarding flow would exclude these applicants, so an alternative verification route may be needed.

• Technical barriers. NFC is a standard feature in mid-range and high-end phones, while budget devices frequently don’t have it. This may exclude certain target groups from your coverage.

• Restricted access to some data. A chip may contain information that a commercial verification service cannot access. For example, fingerprints stored in electronic passports are typically protected by additional controls and can be read and validated by authorities only. Businesses can still use accessible, authenticated personal data and the chip portrait for verification.

NFC identity verification gives businesses stronger evidence of document authenticity while making customer data easier to capture. Its value is greatest when chip checks work alongside document and biometric verification, with an alternative route for customers who cannot use NFC.

With Regula Document Reader SDK, you can add NFC checks to your existing app and verify the chip-reading session on your own server. The same SDK also checks document images, so you can support customers with and without chip-equipped IDs through one integration:

• Reliable verification of over 16,500 documents from 254 countries and territories, including passports, driver’s licenses, and ID cards

• A complete set of authenticity checks, including cross-verification of data from the visual inspection zone, MRZ, barcodes, and RFID chip

• Server-side verification for the mobile results to detect any inconsistencies

If you’re adding NFC to your onboarding flow, tell us which documents your customers use and how they verify their identity today. We’ll help you assess document and device compatibility, plan server-side checks, and work through the alternative route for customers who cannot complete an NFC read. See the solution in action or get in touch to explore how this would fit your app.