Authenticate

AssureID performs a number of authentication tests on a document to determine its authenticity. Each document type in the AssureID Document Library contains a defined set of individual authentication tests that is relevant for that specific document type only. The set of authentication tests performed on one type of document will not be the same as the set of tests performed on another type, although many of the same tests are used. The number and types of authentication tests will vary for a particular document, but a typical document will be subjected to 10–50 individual authentication tests. For example, one test may confirm the presence of security features and/or patterns on the document under one or more light sources, and another may compare the data from different sources on the document (such as MRZ and e-Passport chip). Another test may validate the document response under different light sources (such as UV and IR).

Standard authentication tests

Many authentication tests compare the data from two or more data sources: visible (human-readable) and machine-readable (2D barcode, magnetic stripe, or a contactless smart card) and to verify that they match. The visible and machine-readable fields are crosschecked, within and across both types of data sources. See the Standard authentication test descriptions table for some of the standard authentication tests and possible reasons why these tests may fail.

The failure of a single authentication test will not necessarily result in overall document authentication failure. By performing more authentication tests, the sensitivity of the individual tests can be reduced, which results in fewer false rejects (authentic documents being flagged as suspect). In most cases, fraudulent documents will tend to fail several authentication tests.

There are several variables that are more likely to cause a document to fail:

• Image capture quality (for example blurriness or reflection)
• Personalization of the document (such as especially long names)
• Variations in manufacturing techniques (for example card printed on wrong side or slight variations in printing location)
• Wear and aging of the document (a worn or dirty card can cause failure)
• Tampering and counterfeiting (unlawful changes or reproduction of documents)

Manual document review

GBG offers an optional Manual Review service that provides a manual review of a document if the authentication results are not trusted or under high security requirements. This service requires a subscription and the client application must provide the email and password authentication to access this service. The review transaction requires the client application to provide a subscriptionID, a document instanceID, and type (currently the only type supported is 1 = Identity Documents).

Example

The review results will include the reviewTime (time to review, in milliseconds) and the reviewStage code that identifies the value for the result. See the AssureID Connect transaction API documentation for complete information and values for all codes.

Using webhooks with Manual Review

A webhook is a mechanism for one application to provide other applications with real-time information. Manual Review can notify an application whenever a transaction is created, reviewed, or completed. Manual Review provides the following information for use with any webhook:

• Subscription ID: for example, 9ee7685e-ddd5-4356-b038-d01ba9dbb499
• Transaction ID (also called instance ID): for example, 1a70194c-a932-442c-8c68-242e26a2dfd9
• Review stage: identifies the value for the result
• Time, in milliseconds, either waiting for a reviewer: wait_time, or spent by the reviewer: review_time

For more information about using webhooks with GBG Manual Review, see Webhooks for Manual Review.