Inclusive digital ID poised for leap forward with QR codes, similar credentials

QR codes have been around for decades, but they and other similar technologies have only recently emerged as digital identity credentials with the potential to dramatically improve people’s lives.

The more sophisticated cousin of the humble but ubiquitous barcode came to prominence in many countries during the COVID pandemic as a way to store and retrieve information like restaurant menus. They were already widely used for payments in some countries in Asia, however, and have only increased in use as the pandemic fades into memory.

ID4Africa Executive Chairman Dr. Joseph Atick refers to them collectively as “visible digital seals,” and notes in an interview with Biometric Update that the excitement around them is reflected in the program for ID4Africa 2025.

Tech5 Chairman and CTO Rahul Parthe explains his company’s T5-Cryptograph as a means of replicating the key capabilities of the electronic chips stored in the latest generation of physical identity documents, but in a way much more supportive of identity inclusivity.

“Countries were spending a ton of money making smart cards with chips in them. They could range anywhere between 50 cents to $5 per card.”

For all that cost, the chips themselves are “relatively fragile,” FaceTec VP of Standards Andrew Hughes tells Biometric Update in an email.

These cards, Parthe says, are a “great technology,” but smart card IDs also require an expensive ecosystem to perform identity verification.

The inclusivity potential of QR codes attracted Tech5, and likewise aligns with ID4Africa’s vision of  “making sure no-one is left behind,” Atick emphasizes.

That technology is ready today.

“Finally,” Atick says, “we are now at a place where we can validate, using components off the shelf, using technologies that exist today, that we are now able as a community to create a credential on a piece of paper that not only can be authenticated as genuine, but be linked, or bound, to the individual themselves.”

The ability to bind a person to a QR code using biometrics is one of several major breakthroughs that enables their use in identification.

ICAO began using QR codes for its electronic personal license (EPL) in 2023 to enable online automated verification.

MOSIP developed its Claim 169 largely in response to feedback from the West Africa Unique Identification for Regional Integration and Inclusion Project (WURI).

SQR Group gives users QR codes on their mobile phones as a form of reusable ID.

Identity providers like FaceTec and startups like Ashade have developed technologies that look similar to QR codes, and share important characteristics with them.

The Age Verification Providers Association (AVPA) has even developed an age assurance QR code, in collaboration with the UK PASS scheme.

A session on day three of ID4Africa 2025 in Addis Ababa will focus on these visible digital seals and how they can serve the needs of the identity community, Atick says.

One example of how QR codes serve those needs is found in Cote d’Ivoire, where QR codes bound to individuals  are used to let people in border areas make short trips out of the country and back. The low-cost credentials are printed with a laser printer, and if they are lost or damaged they can easily be replaced.

4 breakthroughs converge

Atick identifies four breakthroughs that allow QR codes and similar technologies to serve identity needs.

First was the selfie becoming a default method of remote identity verification for onboarding, in tandem with the proliferation of mobile phones. Atick notes that “infrastructure will always drive you towards whatever is commonly available,” and the dramatic growth in smartphone penetration makes reading QR codes a natural choice.

Parthe says his company initially thought smart cards would scale enough to bring the requisite scanners down in price to $300. But even the banks found this price prohibitive, on top of the friction of building up the ecosystem.

Another is the biometric binding, which can be carried out with a standard camera capturing the facial image, rather than specialized hardware.

“The criteria is you want to do the binding in a way that is interoperable, that does not lock the county into a specific choice,” Atick says, due to the software license needed to read the bearer’s biometrics.

The digital signature cryptography that allows the relying party to confirm data has not been tampered with through a scan was another breakthrough.

Image compression was a third breakthrough, Atick says, as QR codes can only carry a couple of kilobytes of data. Widely available compressors can now make faces stored in various image formats, such as AVIF or WEBP, easily small enough.

One of the key advantages of using face biometrics, Parthe says, is that the same image can also be used for visual verification. But face introduces the “limits of a qr code can do,” according to Parthe. T5-Cryptographs support face, fingerprint and potentially even voice biometrics.

“We finally came to the conclusion that we need something better, which is more powerful storage-capacity-wise,” he says. QR codes also come with some limitations, he notes, in terms of their shape, the corners getting deleted, and troublesome error rates.

Validation by testing and experience

Even with QR codes, however, the technology has reached production-ready effectiveness.

“The question was raised: can you build a QR Code with all the digital signatures, all the biographic data, and all the error-correcting things, plus a facial image that has quality that will give you a one-to-one selfie match?” Atick says.

NIST has looked at the topic to validate accuracy expectations for using off-the-shelf compressors, and some of the results will be shared at ID4Africa.

Atick was pleased to see the answer from NIST that leading matching algorithms can deliver a false match rate (FMR) of below 1 in 100K, with less than a .4 percent false rejection rate (FRR), using around 960 bytes of data. That represents about half of the storage capacity of the QR code, leaving the other half for everything else the ID contains.

While NIST validated the performance of leading biometric algorithms with massive compression, its tests also showed a significant dependency on image size.

The details matter. If an image is compressed to 600 pixels instead of 960, the matching error rates go up significantly, Atick says. And simple cropped JPEGs deliver error rates up to 90 percent.

Accuracy is one area where Hughes says QR codes storing facial images are far behind UR Codes.

Choice and open standards

Proprietary biometric templates can be stored in QR codes, but Atick says this is “a bad idea, because it will cost you in interoperability.”

A matcher that can compare the template is needed, not just one to match the reference face in the QR code to the live photo.

“What is your ultimate fear?” Parthe asks and answers. “That a vendor sells you the technology and disappears from the face of the earth. If you find a way to mitigate that, you don’t have to go through the hoops of saying ‘let’s adopt something that is open source or open standard, because tomorrow if this guy disappears, I can do it.’  Open standard and open source suffer the issue of lack of innovation.”

Tech5’s approach to alleviating the risk of getting trapped with legacy or unsupported software is “putting the source code in an escrow” or similar checks and balances.

FaceTec’s approach is similar. “UR Code licensing is set up to minimize vendor dependencies or ‘lock in’ and keep government and public sector costs at a minimum,” Hughes explains.

Law enforcement, government licensing offices and healthcare providers have been the most receptive to UR Codes so far, Hughes says. But interest is generally high.

“Almost everyone we talk to is excited about the UR Code protocol and immediately understands the use cases in their organization,” he says. “The key factor is a need to transform a “bearer” document into a ‘biometrically-bound’ document.”

Meanwhile, for governments, Parthe says, “sometimes the funding agencies push them to adopt something open source.” If a funding is a requirement, as it often is, governments will choose something that works, he says, even if it doesn’t work best.

The market emerges

“Of course, this does not remove the smart cards,” Atick says. “If somebody needs higher a higher value credential that can authorize more security and therefore more transactions, higher authentication, yes. But for most applications that we can see, this is good enough.” Licensing the biometric matcher creates value for vendors, in this model.

“I can tell you some matchers for this compression are performing five to seven-times better than other matchers,” he says. “So, there is differentiation in the accuracy of the match.”

For the proprietary model, some countries prefer to make people pay for issuance, and make verification free (as is often the case with chip cards). Others prefer to monetize verifications. In that case Tech5 gives issuers the code for issuance for free, and then gets a cut from the few cents per transaction it is used in.

“Eventually countries will adopt one of the two models,” Parthe says. “And most of the time we’re seeing that they want to use a sustainable revenue generation model, which is the whole concept of decentralized ID.”

Proprietary digital visual seals represent one set of approaches, but Parthe admits that in some cases, governments don’t need to spend the money on proprietary technology. In other cases he believes technologies like T5-Cryptographs are needed, and the market can “keep the QR code for hotel menus.”

Honduras has implemented the T5-Cryptograph for offline identity verification.

In alignment with Parthe, Hughes says, “Where policy requires a human to visually compare a photo to a face then obviously the ‘face in QR’ approach is necessary.” However, he says, “All other scenarios benefit from the UR Code approach – better matching performance than a human, small encoding size to easily fit in small code formats, ability to do automated matching at very high matching performance levels.”

QR codes come with a set of potential risks to cybersecurity and data privacy, to the extent that renowned digital financial services advisor and commentator David Birch recently called for them to be retired. In the identity domain, however, as described above, the QR codes being used are those largely side-stepped by Birch’s argument, when he acknowledges: “I know that many people have devised secure QR codes with digital signatures but those are not what is being used in the mass market.”

Parthe asks what will to stop people from attacks where they present a quishing link instead of an ID.  It also works both ways, unless only authorized relying parties with a proprietary SDK can scan it, anyone can read your identity information.

He notes that supporting multiple biometric modalities, as the T5-Cryptograph does, increases utility. It supports selective disclosure, with different modalities or fingers matched to specific information, and the human factor. How it does this is “easy for even digitally illiterate people to understand. Like, hey; if the guy says show your face and fingerprints, he’s asking for too much.”

While any credential can be hacked, Atick says it will not be worthwhile to target visible digital seals. For the global North, they will be valid for a limited time, maybe for use during a certain journey as a refugee or a person with lost passport (as they are currently being used in Cote d’Ivoire. In the global South, they will be limited in value. Even for $5 or $10 transactions, they would represent low-hanging fruit for inclusion.

They could be appropriate for access to food benefits or medicine, providing a way to deliver life-saving services easily and at low cost.

Burkina Faso was using QR codes to issue lifelong identifiers to infants back in 2022. In many ways, Africa is leading the adoption of visible digital seals, according to Atick, because its governments and businesses need to be “ingenious in trying to create a low-cost solution.”

The technology has clearly matured, and has now been validated by NIST. The next task appears to be sorting out the specifics of which kinds of visible digital seals are best suited to particular use cases.

Article Topics

biometric binding  |  biometrics  |  digital ID  |  Dr. Joseph Atick  |  face biometrics  |  FaceTec  |  ID4Africa  |  ID4Africa 2025  |  QR code  |  T5-Cryptograph  |  TECH5  |  UR Codes