Industry Use Case

3 ways to automate online document verification

December 8, 2021
3 ways to automate online document verification

For most people, an ID document such as a driver’s license or passport is a primary form of identification.

So it comes as no surprise that the majority of apps and websites ask for a government-issued ID as part of their user verification flow.

What’s surprising, though, is the way they’re checking that these documents are real. Most crypto exchanges, banking apps and ridesharing platforms still rely on humans to look over each and every identity document that’s coming through.

A human in the loop does not warrant security

Today’s users expect more — or in this case less — from their digital interactions. They don’t want to spend hours waiting on the result of their verification, they just want to get on with whatever they were doing. Verifying their identity is just a mandatory step in the way.

And not only is it inconvenient for users, manual document verification is also prone to fraud since humans are inherently prone to making mistakes.

Just take a look at N26, a digitally native bank and one of the first apps to offer fully remote account opening to its users. In 2018, the bank came under intense scrutiny from a German business magazine because it was letting customers open an account with a forged ID. (1)

N26 verifies its users’ identity documents via video calls and manual photo verification.

In an interview with TechCrunch, CEO Valentin Stalf said: “One or two people got through with a fake ID document. And we detected that afterward. Unfortunately, we didn’t detect it in real time.”

N26 counted more than 2 million users across 24 countries that year. (2) Having a team of reviewers on staff for each of these countries must’ve cost a fortune — and it still did not guarantee security.

The main reason for this is that it’s incredibly difficult to tell whether a document is genuine when all you have to work with is a single 2D image. Which brings us to our second point…

Image upload is not good enough

The way most apps verify their users’ ID is by asking them to send pictures of their document’s front and back side for review.

Some of them even accept photocopies and images taken from a screen.

Doing this can leave you exposed to a number of attack vectors where a malicious user is able to take a photo of a manipulated image or upload it from the gallery.

And the thing is, altered images can look indistinguishable from real ID documents, thanks to the rise of artificial intelligence and advanced editing software. 

A malicious user can create an AI-generated image of a convincing ID in under a second using real personal data that’s been leaked or stolen. 

Now the question is how to verify documents whose images have been manipulated at scale? Well, it might be best to stay away from images altogether.

Every modern device has a camera attached to it. A camera is your gateway to the user’s physical environment and the feed from it gives you a lot of data to work with.

For example, you can track the way a user moves their document in space to determine if it’s physically present at the time of verification. This way, a user won’t be able to scan their document off a screen or a piece of paper.

Document Verification by Microblink fetching ID data and analyzing the movement of a document to confirm its physical presence. 

Knowing a user has their document with them is a great line of defense against fake IDs. But even a physical document the user is scanning can be tampered with. Which is why we need to dig a bit deeper.

1. Check that the security features are in their right place

Every ID document comes with its own unique set of security features, such as holograms, logos, watermarks and microprint.

Checking that these security features are where they’re supposed to be is a solid first step in verifying the document is real.

Segmenting and pinpointing the security features on an Emirates ID.

One thing to remember when running these checks is that you’ll need to capture a clear image of the document to be able to verify its security features.

But you don’t want the user to do it. Security concerns aside, people tend to take photos that are blurry, obscured, low in resolution or held at an unreadable angle. 

In fact, another N26 study found images of insufficient quality were the main reason for failed verification of identity documents. (2)

You want to automatically snap the clearest image of the document from the camera feed so that the user doesn’t have to do anything besides showing the document to the camera.

A good document verification software will be able to detect the document in space, check if there’s blur on it and separate it from its background.

The end result should be a clear, horizontally aligned image of the document.

Automatically snapping the most suitable document images reduces the amount of effort on the user’s side and builds a foundation for security checks that follow.

2. Compare the ID data for consistency

Nowadays, almost every ID has the document holder’s personal data encoded in some way — whether in a barcode or a Machine Readable Zone (MRZ).

Any mismatch between this data and the data printed on the rest of the document (its so-called Visual Inspection Zone, or VIZ for short) is a telltale sign of tampering.

The difference between MRZ and VIZ on a passport. 

The problem is, ID documents vary wildly from country to country. And while an ID scanner can extract encoded data with relative ease, it tends to struggle with the document’s VIZ.

Reading this unstructured data requires deep document expertise and strong engineering. The software needs to know that on a Malaysian ID card, for example, the first six digits of the document number signify the person’s date of birth, and that the rest are based on their place of birth and gender. 

This is just one example showing how diverse identity documents can be.

3. Match the user’s face with the portrait on the document

Another way of verifying a document is genuine is by asking a user to take a selfie and compare it to the ID photo. 

You’re basically trying to recreate what a bank teller or cashier does when verifying customers in person. Again, you need to be able to capture a clear portrait of the user before comparing it to their selfie.

If the distinctive physiological characteristics on these two images match, there is a high likelihood the user is a genuine owner of the submitted document.

Ready to improve your verification experience?

It feels like apps and websites are taking a path of least resistance when verifying identity documents. 

Today’s users expect more — or in this case less — from their digital interactions. They don’t want to spend hours waiting on the result of their verification, they just want to get on with whatever they were doing. Verifying their identity is just a mandatory step in the way.

Of course, automating document verification won’t help you eradicate the issue of fraud. But it can cut costs, keep the fake ID rate as low as possible, and make the verification experience seamless for your users. Which is really what matters most.

Integrate ID verification into your existing application