eMRTD · ICAO 9303 · NFC · KYC
Remote ID document verification with the NFC chip
Instead of a photo of a passport or ID card, the person holds the document to their Android phone. The chip inside is read through CodeB Wallet – by your server, not by the phone – and checked against the issuing country’s signature. You learn whether the document is genuine and receive its data and photo, signed by the country that issued it. This works with passports from more than a hundred countries and with every EU ID card issued since August 2021.
- Chip signed by the issuing country
- Copies and clones detected
- 115 countries in the master list
What the person sees
1The wallet shows who is asking and what will be read. 
2Enter the CAN or scan the MRZ. 
3Hold the document to the phone until the reading is done. 
4Done – the organisation receives the result.
Why the chip and not a photo of the document
Photos and video calls of ID documents are easy to fake: edited images, printed copies, deepfakes and injection attacks that feed a fake camera picture into the app. Optical checks of holograms on a screen keep getting harder.
The chip is different. Every passport and modern ID card (an eMRTD, electronic machine-readable travel document, ICAO Doc 9303) stores the holder’s data and photo, digitally signed by the issuing country. A changed name or photo breaks the signature, and a copied chip cannot answer the chip’s own key test. That is why the French and German cyber-security agencies (ANSSI and BSI) recommend prioritising chip reading for remote identity proofing.
How remote verification works
- Invitation. Your organisation sends the person a link or QR code from phone.codeb.io – for example from the user list, or inside a sign-up.
- Consent. The link opens CodeB Wallet (it can be installed first). The wallet shows who is asking and what will be read; the person continues or declines.
- Unlock the chip. The person enters the 6-digit card access number (CAN) or lets the camera read the machine-readable zone (MRZ).
- Read. The person holds the document to the back of the phone. The server of phone.codeb.io acts as the reader: it talks to the chip through an end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging). The phone only passes the messages on – it cannot read or change them, so a manipulated app cannot invent a result.
- Result. The server checks the document and records the result. Your organisation sees the verdict, the data and the chip photo.
MRZ and CAN: the key to the chip
The chip does not answer just anyone. Before it releases data, the reader must prove that it has seen the document: with the MRZ – the two or three lines at the bottom of the photo page (document number, date of birth, expiry date) – or with the CAN, the 6-digit card access number printed on the front of many ID cards.
From this key, reader and chip set up an encrypted connection (PACE, or the older BAC on some passports). This protects against skimming: nobody can read a document in a bag from a distance. CodeB Wallet reads the MRZ with the camera, or the person types the CAN.
What is checked
Passive Authentication: the data on the chip must carry a valid signature of the issuing country’s document signer, which must chain to that country’s CSCA certificate from the German BSI master list – and the certificates must not be revoked (CRLs). Country, signer and data must match.
Chip Authentication or Active Authentication: the chip must prove with its own secret key that it is the original and not a copy. Attempts to hide these functions to skip the test count as a copy.
Genuine app on a genuine phone: CodeB Wallet proves to the server with Android Key Attestation and Google Play Integrity that it is the unmodified app on a real device.
Evidence: every reading is stored as a hash-chained evidence record – method, algorithms, certificates, revocation state and the result.
What your organisation receives
The verdict (genuine or not, with reasons) and the data printed on the document: name, date of birth, nationality, sex, document type and number, issuing country, expiry date and the chip photo.
Fingerprints are never read: they are protected by Extended Access Control and only available to border authorities. The person sees what is read before it happens.
Which documents are supported
Every document with a chip that follows ICAO Doc 9303: passports with the chip symbol on the cover, ID cards with a chip and many residence permits.
Whether a document can be confirmed as genuine depends on its country certificate. The BSI master list we use (October 2026) holds 609 country signing certificates of 115 countries plus the EU and the UN – including all EU member states, the United Kingdom, Switzerland, Norway, the USA, Canada, Australia, Japan, India and Brazil. Together these countries issue several hundred million chip documents.
In the EU, every ID card issued since 2 August 2021 must have a chip (Regulation (EU) 2019/1157), and older cards without one are being phased out. Documents of countries outside the list can still be read, but not confirmed as genuine.
Confirmed in our tests, among others: the Maltese passport. Newly added – feedback welcome: ID cards of Finland, Portugal and Spain.
Who needs remote ID verification
Banks, payment and fintech companies – customer due diligence (KYC, anti-money-laundering) when opening an account online.
Crypto-asset service providers – customer identification before trading.
Telecom operators – SIM card and contract registration where the law requires an ID check.
Car rental, car sharing and mobility – identity before the first ride (the driving licence is checked separately).
Online gambling and age-restricted goods – identity and age at sign-up.
Notaries, lawyers and trust service providers – identity before signatures, powers of attorney and certificates.
Employers and staffing agencies – identity and right-to-work checks for remote hires.
Hotels, short stays and travel – guest registration before arrival.
Healthcare, telemedicine and pharmacies – the right patient behind an online consultation.
Marketplaces and platforms – identifying traders and sellers.
Public sector, universities and associations – enrolment and membership without a counter visit.
Which checks your sector needs, and whether chip reading alone is enough, depends on your regulator.
What it does not prove – yet
Chip reading proves that a genuine document was held to the phone. It does not prove that the person holding the phone is the person in the photo. For that, a face comparison with liveness detection against the chip photo is needed; we plan to add it through a certified external provider.
Until then a reading is a document check, not a verified identity, and not eIDAS level of assurance “high”. Remote verification needs a phone with NFC – keep another way for people without one.
How organisations start
Organisations on phone.codeb.io send identity checks to their members from the user list, or let people check their own document when they open an account. Contact info@aloaha.com to set it up for your organisation.
For people: see reading your own passport or ID card and the free CodeB account.
Questions about remote ID verification
What is remote ID verification with NFC?
The person holds their passport or ID card to their phone; the chip is read and its data checked against the issuing country’s digital signature. It replaces photos and video calls of the document.
Why is chip reading safer than a photo of the ID?
The chip data is signed by the issuing country and the chip proves it is not a copy. A photo can be edited, printed or generated; a signed chip cannot be faked without breaking the signature.
What are MRZ and CAN?
The MRZ is the machine-readable zone at the bottom of the photo page; the CAN is a 6-digit card access number on the front of many ID cards. Either one unlocks the chip, so it cannot be read from a distance without the document.
How many ID documents are supported?
Every ICAO 9303 chip document can be read. It can be confirmed as genuine for 115 countries plus EU and UN documents in the BSI master list we use (October 2026), including all EU member states; every EU ID card issued since August 2021 has a chip.
Can a manipulated app fake the result?
No. The server reads the chip itself through an end-to-end encrypted channel; the phone only forwards messages it cannot read or change. The server also checks that it talks to the genuine app on a real phone.
Does it prove that the person is the document holder?
Not yet. It proves that a genuine document was present. A face comparison with liveness detection is planned through a certified external provider.
Which industries use it?
Banks and fintechs (KYC/AML), crypto-asset services, telecom operators, car rental and car sharing, online gambling, notaries and trust services, employers, hotels, healthcare, marketplaces and the public sector.
Install the test version (Google Play) Closed beta: works only for invited testers who are signed in to Google Play with the e-mail address we have on our tester list.