ISO 18013-5 and ISO 18013-7
Stop asking customers to photograph their ID. Verify their mobile driver’s license instead.
ISO/IEC 18013-7 gives you a standard way to replace photo-of-ID-plus-selfie checks with identity data you can verify cryptographically, on the web and in your app.
- Remote: verify mDLs in web and app flows with ISO/IEC 18013-7 and OpenID4VP.
- In person: accept proximity presentation with ISO/IEC 18013-5 over NFC, Bluetooth, or QR.
- Flexible: work across mdoc/mDL, SD-JWT VC, W3C VC, and AnonCreds on one architecture.
Key definitions
How mDL verification works
- mDL
- A mobile driver’s license: a digital version of a driver’s license held in a wallet on a phone. It is issued by a government authority and cryptographically signed, so any change to the data is detectable when it’s verified.
- mdoc
- The signed, machine-readable data format defined in ISO/IEC 18013-5 for credentials held on a device. The format is being extended beyond driving (the ISO/IEC 23220 series) to national IDs, health cards, professional licenses, and age attestations. An mDL is one type of mdoc.
- ISO/IEC 18013-5
- The standard for in-person (proximity) mDL presentation over NFC, Bluetooth, or QR code. It covers face-to-face checks such as airport checkpoints, bar counters, traffic stops, and pharmacy pickups.
- ISO/IEC 18013-7
- The standard for verifying an mDL online, without the holder being physically present. It supports OpenID4VP for web and app identity checks such as bank onboarding, age-gated content, and government portals.
- OpenID4VP
- OpenID for Verifiable Presentations: the protocol that lets a website or app (the relying party) request and receive a credential presentation from a person’s wallet over the internet. It is one of the transport mechanisms ISO/IEC 18013-7 uses.
Return on investment
Where remote mDL verification pays off first
Age verification
Confirm someone is over the age limit without collecting their birthdate, name, or address. Selective disclosure shares only the answer you need, which supports GDPR data minimization and what customers expect. It works the same way at a counter or on a screen.
Financial services onboarding
Replace document uploads and manual review with cryptographic verification of government-issued data. Add authenticated biometrics to bind the credential to the person presenting it. The result is a reusable proof of identity, so KYC doesn’t start from scratch every time.
Government portals
Give citizens simpler access to digital services, backed by cryptographic assurance. Signed, device-bound credentials resist deepfakes and synthetic identities, and people share only the data a service needs.
The flow
From issuance to verification
Issue
A government authority issues an mDL to the wallet on a person’s phone. The credential and each of its data attributes are cryptographically signed and bound to that device.
Request
When the person needs to prove who they are online, such as when opening a bank account, the website or app sends a request to their wallet using OpenID4VP.
Consent and disclose
The wallet shows the person exactly what’s being asked for. With their consent, it shares only those attributes, such as “over 21,” without revealing their name, address, or license number.
Verify
The verifier checks the signatures against the issuing authority’s public key and confirms the response came from the device the mDL was issued to. The result shows whether the data is authentic and unaltered.
The standards
18013-5 got mDLs started. 18013-7 makes them useful online.
ISO/IEC 18013-5 · Proximity
In-person presentation
The holder taps or holds their phone near a reader, and the credential is presented over NFC, Bluetooth, or QR code. The exchange doesn’t need an internet connection, and the reader verifies the signatures itself. US state mDL programs are built on this standard.
- Retail and bar age checks
- Traffic stops
- Airport checkpoints
- Pharmacy pickup
- Event entry
- Hotel check-in
ISO/IEC 18013-7 · Remote
Online presentation
The holder presents the credential over the internet using OpenID4VP. It carries the same cryptographic trust, delivered remotely, so websites and apps can check identity where customers already are. Without 18013-7, an mDL only works face to face.
- Bank onboarding and KYC
- Account creation
- Age-gated content
- E-commerce
- Telecom activation
- Government portals
A platform approach
Identity verification shouldn’t feel like 2015
Deepfakes and synthetic identities keep getting cheaper to make, and photo-of-ID-plus-selfie checks are slow for customers and easy to spoof. With Indicio Proven, you get document validation and biometric authentication built into issuance. Your customers get a cryptographic way to prove who they are, wherever they are, with no uploads and a credential they can use again.
Global interoperability
Indicio Proven supports mdoc/mDL, SD-JWT VC, W3C VC (JSON-LD), AnonCreds, OpenID4VC, DIDComm, EUDI Wallet, ICAO DTC, and Open Badges 3.0 in a single solution. It’s built to work across jurisdictions, so a credential issued in one country can be verified in another.
High identity assurance
Government-issued identity documents from around the world can be authenticated and turned into tamper-evident verifiable credentials. Biometric authentication with liveness detection and face matching is part of issuance, so the credential is bound to the real person and resists deepfakes and synthetic identities.
Deploy without disruption
Indicio Proven adds a trust layer to the systems you already run, so there’s no rip and replace. Integrate with existing IAM, mobile apps, and cloud environments through APIs and a mobile SDK. Start small and expand: simple implementations take days, and national deployments are measured in months, not years.
FAQ
Frequently asked questions
What is an mDL?
An mDL is a mobile driver’s license: a government-issued driver’s license held in a wallet on a phone. It’s cryptographically signed, so it can be verified without manual document review.
What’s the difference between an mDL and an mdoc?
An mdoc is the signed data format for credentials on a mobile device, defined in ISO/IEC 18013-5 and being extended to other credential types in the ISO/IEC 23220 series, such as national IDs, health cards, professional licenses, and age attestations. An mDL is one type of mdoc: a driver’s license.
Do I need ISO/IEC 18013-7 if I already support 18013-5?
Yes, if you do any remote onboarding, online account access, or identity checks in a website or app. ISO/IEC 18013-5 covers in-person presentation only. ISO/IEC 18013-7 covers remote presentation and supports OpenID4VP, which lets you verify an mDL wherever your customers are online.
How does mDL verification reduce privacy risk?
The mdoc format supports selective disclosure, so a person shares only the attributes a check needs. An age check can confirm “over 21” without exposing name, address, or license number. That supports the data minimization principle in GDPR and US state privacy laws, and meets consumer expectations.
Why choose Indicio Proven for mDL?
Indicio Proven verifies mDLs both in person (ISO/IEC 18013-5) and remotely (ISO/IEC 18013-7), on a platform that also issues and verifies other credential formats across sectors and jurisdictions. You get a white-label wallet, a mobile SDK, APIs, and ongoing support, with mdoc/mDL, SD-JWT VC, W3C VC, and AnonCreds on one codebase, so you can add new credentials and use cases without starting over.
Next step
Get your license to verify
Whether you’re a state DMV issuing mobile driver’s licenses, a bank accepting them for KYC, or a platform preparing for the EUDI Wallet, we’ll show you how Indicio Proven adds mdoc issuance and verification to the systems you already run.
- 30 minutes
- With our technical team, not sales
- No commitment
