First-Time Passports Going Online: What Digital Identity Verification Must Get Right

On Sept. 29, the State Department announced that starting next year, people applying for their first US passport can do the whole thing online. Before this, first-timers had to show up in person. Someone looked at your face, looked at your documents, and made sure the two matched.

That in-person check is going away, which puts a lot of weight on digital identity verification. 

The government hasn't said yet how it will verify applicants, so I'll be upfront: I don't know how they're designing this, and nobody outside that team does either. What I can do is walk through what a safe version would need, where it could break, and what it means for teams that run KYC onboarding every day.

TL;DR: What do online passports mean for digital identity verification?

A safe online process needs more than a selfie and a driver's license. It needs five checks to pass together: SSA verification of name, DOB and SSN; validation of the driver's license against the issuing state's records; electronic verification of a birth record as proof of citizenship; a selfie with strong liveness detection, and a one-to-many face search across State's existing photo records. Built that way, it should be fairly secure, but onboarding teams should watch it closely.

• The main risk is an impostor using their own face, not a deepfake of you. A fraudster who forges a license with your details and their photo passes liveness and face match. The passport then carries their face, so it works at the border too.

• Liveness still matters, but it isn't the whole defense. It has to catch presentation and camera injection attacks. It can't catch a real person holding a forged license.

• Citizenship has to be proven, not assumed. SSN and license checks don't establish citizenship.

• Address signals matter more than device data. Watch for new or thin address history, repeated addresses, and PO boxes.

• A fraudulent passport is useful everywhere. It can open accounts and loans, and, if issued with the fraudster's photo, cross borders.

Who can actually use a fraudulent passport?

My honest first thought was that this could be a goldmine for passport fraud. A US passport is a big prize, and a lot of people would want one.

It's tempting to think the risk is limited because the fraudster's face won't match the victim's at the border. That only holds if the fraudster has to look like the victim. In practice, they don't. The classic attack is a "fraudulently obtained genuine" passport: a real passport, issued on fake supporting documents, carrying the fraudster's own photo and someone else's identity.

This isn't hypothetical. In 2009, GAO investigators obtained four genuine passports using counterfeit documents and the SSNs of fictitious or deceased people. One investigator then used a passport to buy an airline ticket, clear airport security, and board a plane (Nextgov, GAO-09-447). In a 2010 follow-up, State issued five of the seven passports GAO attempted to get (GAO-10-922T).

So a fraudulent passport is useful in two places: opening accounts and applying for loans, which is what KYC teams care about, and crossing borders, which is what the State cares about.

What would a secure online passport process need?

If I were designing this, I'd want five checks, and I'd want an applicant to pass all of them before anything gets issued. Each one covers a gap the others leave open.

None of this process should be low friction. If anything fails, the applicant should be sent to apply in person.

A real ID tells you a document is real, but it takes more signals than that to know the person is.

Where could digital identity verification break?

From the fraudster's perspective, SSA verification isn't much of a barrier. Name, date of birth, and SSN are table stakes; so much data is already out there.

The forged license is the weakest link. A fraudster needs a license with the victim's details and, in the impostor scenario, their own photo. Right now, there’s no way to check that the photo on a driver’s license or state ID matches what the DMV has on file. However, where a state offers a signed mobile driver's license, verifying its cryptographic signature is stronger than inspecting an image of a plastic card.

Document verification looks for tampering, and the barcode on the back of a license encodes the same name, date of birth and address as the front. But barcodes can be spoofed, and a forgery that copies real license details will also pass a data check against the DMV. Once the license is accepted, liveness and face match can't help: they confirm that a real person matches the card, not that the card is genuine. This is where the one-to-many face search and the address controls carry weight.

Fake live selfies come in two main forms:

• Presentation attacks. The fraudster holds a photo or screen up to the camera. Good presentation attack detection looks at depth, lighting and other cues, and can tell it isn't a person.

• Camera injection attacks. A fake video is fed in between the camera and the app, like a man-in-the-middle attack on your webcam. What the app receives isn't what the camera sees.

Put it all together and my take is that faking all five checks at once is much harder than it sounds. Not impossible, and the forged license is where I'd expect attackers to focus.

Why isn't this a fraud-at-scale problem?

Beating a selfie check is no longer a one-off effort, because injection tools are now sold off the shelf and can be reused across attempts. What’s hard to reuse is everything around the selfie: a convincing forged license for each identity, a verifiable birth record for each identity, and a delivery address the fraudster controls. And if State runs a one-to-many face search, each attacker’s face can only be used once. As long as those controls are in place, this stays targeted and slow.

It also changes which signals matter. When fraud happens at scale, device and IP data is very useful, because the same device or IP keeps showing up. The people capable of beating these checks are sophisticated and cycle through devices and IPs all the time. Device and behavioral intelligence is still a good control against less sophisticated fraudsters, but here it has to work alongside other signals instead of carrying the decision.

Are other high-assurance IDs going digital?

High-assurance IDs are already becoming more digital. In California, I don't need to carry my physical driver's license anymore. I can add it to my phone's wallet and use that instead.

But look at how the DMV handles the risky moments. I can renew my license online, and the new card gets mailed to the address on file. If I change my address, I have to come in. If I change my name, same thing. And as far as I know, I can't get my first license online at all.

That tells you where identity assurance really sits. If someone wants to take over my license, they also need access to my address to receive it. The address is doing a lot of work.

What should KYC onboarding teams watch?

When people are asked to scan an ID during onboarding, most reach for a driver’s license or state ID rather than a passport. Far more Americans carry a driver’s license than a valid passport. So this isn’t a flood of risky passports arriving tomorrow.

Still, there are a few signals I'd put more weight on in onboarding workflows:

• Address history. If the address on an application is new to that identity and has very little history behind it, that's a strong signal. A passport gets shipped somewhere, and a fraudster needs that somewhere to be a place they control.

• Address velocity. If several applications have come in using the same address, pay attention.

• PO boxes. You don't want passports, or new accounts, tied to a PO box.

• How the passport was issued. If there's ever a way to know a passport was issued fully online, with no in-person step, that itself is a useful signal. I wouldn't decline on it alone, but it's a good reason to give the application a higher risk score and look closer.

A watch-closely moment

Overall, if the government builds this with checks like the ones above, I think it'll be fairly secure for now. But it's definitely a watch-closely moment. People will try to break it, and over the next year, the news will tell us whether anyone is getting IDs in someone else's name.

In the meantime, the best move for onboarding teams is the same as it's always been: don't let one document carry the whole decision. A real ID tells you a document is real, but it takes more signals than that to know the person is.

The fraudsters who can beat a liveness check can usually beat traditional device fingerprinting too. Our on-demand webinar, Beyond Traditional Device Intelligence: The Future of Digital Identity & Fraud Prevention, covers what it takes to catch them.

FAQs

Can you apply for a first-time US passport online?
Not yet. The State Department announced on Sept. 29 that first-time applicants will be able to apply fully online starting next year. Until then, first-time applicants still have to apply in person.

What is digital identity verification?
Digital identity verification confirms that a person is who they claim to be without meeting them in person. It usually combines a data check (like name, date of birth and SSN), a check of a government ID document, and a selfie with liveness detection to confirm a real person is present.

What's the difference between a presentation attack and an injection attack?
In a presentation attack, a fraudster shows the camera something fake, like a printed photo or a screen. In a camera injection attack, they skip the camera entirely and feed fake video straight into the app. Injection attacks are harder to catch because the app never sees what's actually in front of the camera.

Could a fraudster get a real passport in someone else's name?
Yes, and it’s happened before. In 2009 and 2010, GAO investigators got genuine passports using counterfeit documents. Online, the likeliest attack is a forged driver’s license with the victim’s details and the fraudster’s own photo, which can pass liveness and face match. That’s why a secure process also needs birth record verification, a one-to-many face search, and address controls.”

What is eCBSV?
eCBSV is the Social Security Administration's electronic Consent Based SSN Verification service. With the person's consent, it confirms whether a name, date of birth and Social Security number match SSA records. It’s how financial institutions run the same SSN check during KYC onboarding..

Should KYC teams treat passports differently now?
Not overnight. Passports are a small share of IDs used in onboarding, and online issuance hasn't started. But it's worth giving more weight to address history, address velocity and PO boxes, and to watch for any way to tell how an ID was issued.