Most people meet online identity verification as a short interruption: hold up your card, turn your head, wait a moment. Behind those sixty seconds sit three separate questions, and each one is answered by a different technique. Knowing which is which helps you choose a provider, read its results, and explain the step to your own users.
The short answer
An online ID check asks three things. Is the document real and still valid? Is a live person in front of the camera right now? Is that person the one on the document? The first is answered by reading the document, the second by a liveness check, the third by comparing the two faces. A check is only as strong as the weakest of the three, so a good flow runs all of them on images captured live, not on files uploaded from a gallery.
Why live capture matters
Many older verification forms let the user upload a photo of their ID. That is convenient and easy to abuse. A photo in a gallery could be a scan of someone else's card, an edited image, or a picture taken off a screen. When the camera is opened by the verification page itself and the image never passes through the photo library, a whole class of shortcuts disappears.
Live capture also gives better images. The page can show a frame for the card, wait until the card fills it, and reject blurred or cropped shots before they are sent. Fewer bad images means fewer honest users declined for reasons that have nothing to do with who they are.
Check one: reading the document
Every passport, and many national ID cards, carry a machine-readable zone: two or three lines of capital letters, digits and < signs printed along the bottom of the photo page or on the back of the card. The format is set by the International Civil Aviation Organization in its Document 9303, so it is the same everywhere in the world. A passport uses two lines of 44 characters; most ID cards use three lines of 30.
Those lines hold the document type, issuing country, document number, date of birth, sex, expiry date, nationality and name. More importantly, they hold check digits. Each key field is followed by a digit calculated from the field itself, using repeating weights of 7, 3 and 1. A final check digit covers several fields together. If someone edits a date of birth or an expiry date and does not recalculate the digits correctly, the numbers no longer add up.
So reading the document is really four steps:
- Find the card or passport page in the image and straighten it, even when it was held at an angle.
- Locate the code lines and read them with character recognition trained for that typeface.
- Fix the classic confusions, such as the letter O read as the digit 0, using the fact that each position should hold a letter or a digit.
- Recalculate every check digit and confirm the expiry date has not passed.
When all four pass, you know the code lines are internally consistent and the document is in date. You do not yet know the person holding it is its owner. That is what the next two checks are for.
Check two: proving a live person is present
A face match on its own is easy to fool: hold a printed photo, or a phone showing a photo, in front of the camera. Liveness detection, which standards call presentation attack detection, exists to stop that. There are two broad approaches.
Active liveness asks the user to do something a flat picture cannot do convincingly, such as turning the head to one side and then the other. The system follows the face across many frames, estimates the angle of the head in each one, and checks that the movement is smooth and continuous. A photo can be tilted, but it does not produce the changing geometry of a real head turning.
Passive liveness asks for nothing. It looks at a single image or short clip for signs of a screen, paper or mask: moiré patterns, reflections, edges, flat lighting, missing depth. It is faster for the user but needs carefully trained models. Many providers combine the two, using the active step as the main signal and passive analysis as a second opinion.
The international standard for testing these systems is ISO/IEC 30107-3. If a provider claims compliance or certification against it, ask which test level, which laboratory, and when.
Check three: matching the face
The last question compares the face from the selfie with the face printed on the document. Modern systems do not compare pixels. A recognition model turns each face into a list of numbers, often called an embedding, and the two lists are compared to give a similarity score.
The decision then depends on a threshold. Set it too low and different people are accepted as the same person. Set it too high and real owners are rejected because the document photo is ten years old, they now wear glasses, or the light in the room was poor. There is no single correct number: the right threshold depends on the model, the quality of the images, and how costly each kind of mistake is for your business. A good provider calibrates on real captures and tells you what score it returned, not just yes or no.
What each check catches, and what it misses
| Check | Catches | Does not catch on its own |
|---|---|---|
| Code lines and check digits | Edited dates and numbers, misread images, expired documents | A genuine document held by someone else |
| Liveness | Printed photos, photos on a screen, replayed images | A live person using someone else's document |
| Face match | A live person who does not match the document photo | A good-quality photo of the owner held up to the camera |
| All three together | The common attacks above, in one flow | Well-made physical forgeries, which need chip reading or a document specialist |
The last row matters. A consumer phone browser can read the printed page, but it cannot read the chip inside an electronic passport. For most websites and apps, the three checks above give a sound level of assurance. For regulated onboarding, such as opening a bank account, the rules in your country may ask for more, and you should check them before choosing a flow.
What happens to the images
Identity checks handle some of the most sensitive data there is: a government document and a face. The safest image is one that is not kept. A careful flow keeps only what it needs to finish the check, deletes it as soon as the decision is made, and returns the extracted data to the business that asked for the check, not to anyone else. Ask any provider three questions: what is stored, for how long, and where.
At lumex.id the photo side of the document is held only while the check runs and is deleted when it finishes, or when an unfinished link expires. The full approach is set out on our security page and in the biometric data notice.
How lumex.id runs the three checks
lumex.id runs all three in a single flow in the phone browser, with no app to install. The user scans the front and back of a national ID card, or the photo page of a passport, using the live camera only. The code lines are read and every check digit is verified. The user then turns their head left and right while the camera records a short sequence of frames, which is used for liveness and for the face match against the document photo.
Your server receives a clear result: approved or declined, the reasons for any decline, the fields read from the document, and the face match score. The developer reference shows the full request and webhook format, the supported documents page lists what can be scanned, and pricing starts at $19 a month with 50 checks included.
Where this fits
If you run a marketplace, a booking site, a rental platform or any service where you need to know a real adult is behind an account, a document, liveness and face check is usually the right starting point. Start with test keys, run the flow on your own phone, and look at what comes back before you switch on live checks.
Frequently asked questions
Can a user verify with a photo from their gallery?
Not with lumex.id. The document and the face are both captured with the live camera inside the verification page. Gallery uploads are not accepted, because they are the easiest route for edited or borrowed images.
Which documents work?
Passports and national ID cards that carry machine-readable code lines. That covers every current passport and many ID cards. Cards without code lines are not supported yet.
How long does a check take?
For the user, usually under a minute: two card photos and a short head turn. The automated checks themselves take a few seconds.
What does a face match score mean?
It is a measure of how similar the two faces are, from 0 to 1. The decision compares it with a threshold. We return the score with every result so you can see how close a decision was.
Is a passing check proof of identity in law?
No check is a legal guarantee. It is strong evidence that a live person holding a valid document matches its photo. If your industry is regulated, confirm what your regulator requires.