NFC chip verification for passports & eID
The contactless chip inside an ePassport or biometric residence permit is the single strongest signal you can capture during onboarding: it holds the issuing authority’s digitally-signed copy of the holder’s identity data. Zanyara reads that chip on the applicant’s own phone and verifies its signature on our servers — so you learn not just what a document says, but that a genuine, government-issued chip said it.
Why the chip beats a photo of the data page
A printed data page can be forged, reprinted or edited in software, and a photo of it only ever proves the photo exists. The chip is different: it carries a cryptographic signature from the country that issued the document, and that signature cannot be reproduced by a forger. Reading and validating it moves a decision from “this looks real” to “this is cryptographically genuine and unaltered.”
How Zanyara verifies the chip
- Read the MRZThe SDK reads the machine-readable zone (or reuses it from document capture) to derive the access key that unlocks the chip.
- Open a secure channel (BAC / PACE)The phone establishes an encrypted session with the chip using that key, so the exchange can’t be skimmed by a bystander’s reader.
- Read the chip on-device (iOS CoreNFC / Android JMRTD)The data groups — DG1 identity, DG2 the signed face image, and the SOD security object — are read directly from the chip on the applicant’s handset.
- Passive authentication, server-sideZanyara verifies the SOD’s digital signature, recomputes and compares the hash of every data group against the signed values, and chains the signing certificate to a trusted CSCA (Country Signing Certificate Authority) masterlist. The chip passes only if all three hold.
The part the open-source readers leave out
Reading a chip is the easy half. Open-source libraries — NFCPassportReader on iOS, the tananaev reader on Android — will hand you the raw data groups. What they don’t give you is the compliance layer that makes the result trustworthy: passive- authentication validation against a maintained CSCA trust store, hash-mismatch and tamper detection, an auditable pass/fail decision your reviewers and regulators can rely on, and someone to call when a national issuer rotates a signing certificate. Zanyara ships that layer as a supported API alongside the SDKs.
Supported documents & platforms
- Documents: ICAO-compliant ePassports worldwide, UK biometric residence permits (BRPs), and national eID cards with an eMRTD chip.
- Platforms: native iOS SDK (CoreNFC) and Android SDK (JMRTD-based), plus the server-side passive-authentication API.
- One decision: the chip result is returned alongside the rest of the check — document, face match, liveness and AML screening — in a single verification outcome.
Frequently asked questions
- Does NFC passport reading work on both iOS and Android?
- Yes. Zanyara provides a native iOS SDK (using CoreNFC, iPhone 7 and later) and a native Android SDK for NFC-enabled devices, so the chip is read on the applicant’s own phone during capture.
- What is passive authentication?
- It is the ICAO check that proves a chip is genuine: verifying the issuing authority’s digital signature on the document security object (SOD), confirming the hash of every data group matches the signed values, and chaining that signature to a trusted country certificate (CSCA). Zanyara runs all three server-side.
- Which documents have an NFC chip?
- ICAO-compliant ePassports (they carry the camera/chip symbol on the cover), UK biometric residence permits (BRPs), and many national eID cards. Documents without an electronic chip fall back to Zanyara’s visual and machine-readable-zone checks.
- Can it detect a cloned or tampered chip?
- Passive authentication detects tampering directly — any altered data group fails its hash check, and a chip that is not signed by a trusted authority fails the certificate chain. Detecting a bit-for-bit clone of a genuine chip additionally depends on the document supporting active or chip authentication.
- Do I need the physical document, or does a photo work?
- NFC requires the physical document held to the phone. That is the point: the chip cannot be photographed or copied — it can only be read from the genuine article, which is what makes it the strongest single signal in a verification.