What Is Digital Identity Verification: 3 Checks, Not One

Belgium built a national identity card with a cryptographic chip. Unbreakable math. And researchers found a way around it anyway, not by cracking the chip, but by exploiting the software that read the card. The credential was flawless. The system that trusted it wasn't.

If you've ever tapped a digital I

If you've ever tapped a digital I.D. into an app, or uploaded a photo of your driver's license to open a bank account, you've already used one of these systems. And I think a lot of us assume that little word, verified, means somebody actually checked. That assumption is where the trouble starts. According to reporting from Biometric Update, a digital credential has to survive three separate tests before it deserves your trust, and plenty of systems only run one of them. So what are the three checks, and which one do people skip?

Let's start with the framework, because once you have it, everything else clicks. Check one, is the issuer real, and do they still have the authority to issue? Check two, is this specific credential still current, or was it revoked? Check three, is the person handing it over actually the rightful owner, or just someone holding it? Three links in a chain. Break any one, and the whole thing fails. Previously in this series: What Is Digital Identity Verification 3 Checks Not One.

The article uses an analogy I really like. A digital credential works like a notarized check. The notary stamp is the cryptographic signature, proof the bank issued it. The routing number confirms the bank still exists and still has authority. And the account number and signature confirm you're the rightful holder. A check can look perfect and still bounce. Closed account. Revoked authority. Wrong signature. Each of those is a separate check at the bank, not one magic glance.

That first link is stranger than it sounds

Now, that first link is stranger than it sounds. When a verifier checks a digital signature, it needs the issuer's public key, basically a published fingerprint that proves who signed the document. If the verifier can't reliably confirm it has the real issuer's key, an attacker can sign a fake credential while pretending to be the government. The math works perfectly. It's just doing the math against the wrong key. For the rest of us, that means a credential can be cryptographically valid and completely fraudulent at the same time.

But the deepest problem happens before any of this. Researchers call it the origination problem. Every one of those three checks assumes the credential was issued to the right human being on day one. And how do many private companies verify identity at signup? They email you a link and ask you to click it. That's it. That's the enrollment. If someone gets a credential issued under a false name, no amount of downstream verification will ever catch it. The lie is baked in at the source. Up next: Biometric Data Meaning One Face Scan 75 Year Record.

So why do we all trust that checkmark? Because the word verified collapses three separate operations into one label. Nobody designed it to mislead you, it's just shorthand, and shorthand hides work that didn't happen. Most systems only confirm step one, that the document itself is mathematically intact. The issuer could be compromised. The credential could be revoked. The holder could have stolen it. And you'd still see a checkmark.