How essentry Verifies Identity in 20 Seconds: A Three-Step Process at Border Control Level

Key Takeaways‍

• essentry's identity verification combines three independent steps — document authentication, liveness detection, and biometric face matching — all completed in approximately 20 seconds

• The document scanner uses three light sources (white, infrared, UV) to detect security features that smartphone-based online verification systems cannot access

• Liveness detection is iBeta-certified to ISO/IEC 30107-3, defending against printed photos, video replays, silicone masks

• The face matching algorithm is benchmarked against NIST's Face Recognition Technology Evaluation (FRTE), achieving false non-match rates well below 0.5% — a correct recognition rate exceeding 99.5%

• All three steps must succeed for essentry to consider an identity verified — no single step substitutes for another

‍

Schedule a demo to see identity verification in action →

‍

What Does It Actually Mean to Verify an Identity?

‍Secure identity verification is critical for all industries in the critical infrastructure sector and a key factor in business continuity. A highly secure and automated identity verification process simultaneously answers three questions: Is the presented ID document genuine? Is it being presented by a real person? And is this person actually the one pictured on the document?

essentry answers these three questions through a fully automated process in which each individual verification step takes only a few seconds. This enables essentry to meet the standards of international border control. Here is how each step works.

Step 1: Document Authentication

‍What happens at the kiosk

The essentry kiosk checks the authenticity of identity documents— passport, national ID card, or driver's license — using three distinct light sources.

‍

White light: captures the visible appearance of the document: print quality, color, layout, and visual security features.

Infrared light (IR): reveals security features invisible under normal light. Specific inks and printing techniques react predictably to IR; deviations from the expected pattern indicate manipulation.

Ultraviolet light UV): exposes fluorescent security features such as UV patterns, security fibers and threads, planchettes, and special inks visible only under UV illuminatio.

‍

The essentry kiosk validates up to 20 document-specific security features — covering both visible and invisible characteristics unique to each document type. All ID document scans are processed exclusively on the kiosk locally and are permanently deleted immediately after verification.

The software checks:

• Presence and correctness of all expected security features

• Consistency between the machine-readable zone (MRZ), visual inspection zone (VIZ), barcode, and RFID chip (where present)

• Printing techniques (intaglio, offset, engraving, etc.)

• Signs of manipulation such as erasures, overlays, or chemical alteration

Quality level: border control standard

essentry uses the same class of document scanners and inspection procedures deployed at international border crossings. The hardware comes from leading manufacturers of forensic document readers in active use by border agencies, immigration authorities, and law enforcement worldwide.

How physical identity verification differs from online verification

‍Online identity checks — common during account opening or video-ident processes — rely on smartphone photos of an ID document. Only one light source is available: the camera flash. This fundamentally limits inspection depth, and relevant security features remain invisible to photo-based systems.

‍

‍

Step 2: Liveness Detection

‍What happens at the kiosk

After document inspection, the kiosk 3D camera captures an image of the person standing in front of the device. Before this image is used for biometric facial matching, the system confirms that a genuinely live, physically present person is standing there — not an artifact or impersonation attempt, known as a presentation attack.

Presentation attacks can take many forms:

• Printed photos of another person held in front of the camera
• Video playback on smartphones or tablets
• Paper masks or cut-outs
• 3D masks made from silicone, latex, or resin
• Deepfake videos or digitally manipulated images

Liveness detection analyzes subtle characteristics that are often imperceptible to the human eye: micro-movements, skin texture and reflective properties, depth features, and three-dimensional facial geometry.

Quality level: iBeta-certified to ISO/IEC 30107-3

The international standard for evaluating liveness detection systems is ISO/IEC 30107-3. The leading independent testing laboratory is iBeta Quality Assurance (USA), accredited by NIST NVLAP (Lab Code 200962-0).

iBeta tests across three levels of increasing attack sophistication:

‍

Level 1 — Defends against basic attacks: printed photos, video playback, paper masks

‍Level 2 — Defends against advanced attacks: high-quality 3D masks (silicone, latex, resin), realistic mannequins, digitally composited faces

‍Level 3 — Defends against expert-crafted attacks: custom-made hyperrealistic masks with adapted environmental conditions

‍

iBeta certification has become the de facto standard for liveness detection. Government agencies, banks, and regulated enterprises increasingly require it as a baseline procurement criterion.

‍

‍Learn more: iBeta Biometrics Testing →

‍

Step 3: Biometric Face Matching

What happens at the kiosk

In the final step, the system compares the live image of the person — which has passed liveness detection — against the photo on the identity document. This 1:1 verification answers a single question: Is the person standing at the kiosk the same person pictured on the ID?The algorithm extracts biometric templates from both images: mathematical representations of facial geometry, including distances and proportions between eyes, nose, mouth, chin, and forehead. These templates are compared and produce a similarity score. If the score exceeds a defined threshold, the match is confirmed.

Quality level: NIST FRTE ranking

The globally recognized benchmark for face recognition algorithms is the Face Recognition Technology Evaluation (FRTE) conducted by the National Institute of Standards and Technology (NIST) in the United States. FRTE 1:1 Verification tests algorithms in exactly the scenario essentry uses: a one-to-one comparison between a live capture and an enrolled photo.

NIST tests with large, real-world datasets — visa photos, border control captures, and mugshots — and evaluates three core criteria:

• False Non-Match Rate (FNMR): How often is a genuine person incorrectly rejected? Lower is better.
• False Match Rate (FMR): How often are two different people incorrectly accepted as the same person? Lower is better.
• Demographic fairness: How consistently does the algorithm perform across age groups, genders, and ethnicities?

Hundreds of algorithms from vendors worldwide are evaluated on an ongoing basis. The top-performing algorithms today achieve FNMR values well below 0.5% at extremely strict FMR thresholds — meaning they make the correct decision in more than 99.5% of cases.

‍

Current rankings: NIST FRTE 1:1 Verification →

Why All Three Steps Are Required

Each step closes a specific gap that the others leave open:

Document authentication confirms the ID is genuine — but says nothing about who is holding it.

Liveness detection confirms a real, present person is in front of the camera — but says nothing about which person.

Face matching confirms that the live person matches the document photo — but only means something if the document itself is authentic and the face capture is real.

Remove any one step and the verification is incomplete. This is why essentry considers an identity verified only when all three steps succeed.

Data Protection by Design

The ID verification occurs only locally at the kiosk. Once verification is complete, the ID image is deleted immediately from working memory. Only operationally necessary data — name, badge number, and the guest photo — is transferred to the essentry platform. No personal data is stored on the device itself.

essentry is ISO 27001 certified (based on BSI IT-Grundschutz) and all data centers are located in Germany. Full GDPR compliance is maintained throughout the verification process.