NFC (Near Field Communication)
NFC (Near Field Communication) is a short-range wireless standard that lets two devices exchange data when they are held within a few centimeters of each other. In identity verification, NFC is how a smartphone reads the encrypted chip embedded in an ePassport or eID card — pulling cryptographically signed data straight from the document rather than from its printed surface.
| Full name | Near Field Communication |
| Operating frequency | 13.56 MHz |
| Practical read range | ~4 cm (the specification allows up to ~10 cm) |
| Core standards | ISO/IEC 18092 (NFCIP-1), ISO/IEC 14443 |
| Data rates | 106, 212, and 424 kbit/s |
| Use in ID documents | ePassports and eID cards per ICAO Doc 9303; mobile driver’s licenses per ISO/IEC 18013-5 |
| Power source | The reader’s own field — chips inside ID documents carry no battery |
How NFC works
NFC is inductive coupling, not radio broadcasting. The reader — a phone, a border kiosk, a payment terminal — generates an alternating magnetic field at 13.56 MHz. When a chip enters that field, the field induces enough current in the chip’s antenna to power it and carry data in both directions. No battery, no pairing, no configuration.
That physics is the point. Because the field falls off sharply with distance, the working range collapses to about four centimeters. You have to deliberately place the document against the reader, which makes NFC a poor target for the kind of remote interception that longer-range wireless technologies invite.
NFC devices operate in three modes: reader/writer (a phone reads a passive tag or chip), card emulation (a phone behaves like a contactless card, which is what powers tap-to-pay), and peer-to-peer. Identity verification uses the first one almost exclusively.
Why NFC matters for identity verification
Every printed security feature on an ID document can eventually be reproduced. Holograms get counterfeited. Fonts get matched. Microprint gets photographed at high enough resolution to fool a human reviewer and a lot of software.
The chip is different, because it doesn’t rely on appearance at all.
An ICAO Doc 9303 compliant chip stores the holder’s biographic data and facial image alongside a Document Security Object signed by the issuing country’s certificate authority. When a reader performs passive authentication, it verifies that signature against the country’s public key. If a single byte of the stored data has been altered, the signature fails. Additional protocols — Active Authentication and Chip Authentication — bind the data to that specific physical chip, so a bit-for-bit copy of a real passport’s chip contents won’t pass on a cloned card.
Access is gated too. Before a reader can talk to the chip, it derives a session key from the document number, date of birth, and expiry date printed in the machine-readable zone — using BAC, or its successor PACE. You need physical possession of the document to read it.
Chip reading is one layer inside a broader identity document verification stack, sitting alongside visual authentication, optical character recognition, and biometric matching. It’s the layer that turns “this document looks real” into “this document was issued by this government and hasn’t been modified since.”
NFC vs RFID
NFC is a subset of RFID, which is why the terms get used interchangeably and why that’s a problem in verification contexts. The distinction matters:
| NFC | RFID | |
|---|---|---|
| Frequency | 13.56 MHz only | 125 kHz to 960 MHz, depending on class |
| Range | ~4 cm | Centimeters to 100+ meters (UHF) |
| Communication | Two-way | Typically one-way, tag to reader |
| Encryption | Standard in ID and payment applications | Often absent in basic tags |
| Typical use | Passports, eID cards, contactless payment, transit | Inventory tracking, livestock tags, access badges, tolling |
Put simply: every NFC device is an RFID device, but almost no RFID tag can do what an NFC chip in a passport does. A warehouse RFID tag announces an identifier to anything listening. An ePassport chip refuses to say anything at all until the reader proves it is holding the document.
What NFC can’t do
It verifies the document, not the person. A chip read confirms the credential is authentic and unaltered. It says nothing about whether the person presenting it is the person it was issued to. That gap is closed by liveness detection and biometric matching against the facial image stored on the chip itself.
Coverage is uneven. Most passports issued in the last fifteen years contain a chip. Driver’s licenses and national ID cards vary enormously by country and issuing authority — many carry no chip at all, which is why barcodes remain a critical verification surface.
It depends on reading the printed document first. Because the access key is derived from the MRZ, you cannot read the chip without first capturing the data page. NFC is a second step, not a replacement for document capture.
A genuine chip can belong to a compromised document. Passive authentication proves the passport was legitimately issued. It cannot know the passport was reported stolen last week. That check requires separate data sources.
Frequently asked questions
Can the NFC chip in a passport be cloned?
The stored data can be copied, but a copy won’t pass a full verification. Active Authentication and Chip Authentication require the chip to prove possession of a private key that never leaves the hardware, so a duplicated chip fails the challenge even when its contents are identical.
Do all ID documents have NFC chips?
No. Chips are near-universal in passports issued since the mid-2000s and common in national eID cards across the EU and Asia. Coverage in driver’s licenses is far patchier, though mobile driver’s licenses under ISO/IEC 18013-5 support NFC as a transfer method.
Is it possible to skim personal data from an ePassport?
The four-centimeter range and MRZ-derived session key make casual skimming impractical. An attacker would need to be pressed against the document and already know the printed details required to derive the key.
What does a phone need to read an ID chip?
An NFC radio and OS-level access to it. Modern iOS and Android devices both expose the required APIs, which is what made mobile chip reading viable outside border-control hardware.
