How to verify a mobile driver licence at point of sale (QR, NFC and offline)

To verify a mobile driver licence (mDL) at point of sale, the holder consents and shares selected fields over a local channel — a QR code to start, then Bluetooth or NFC to transfer the data — and the reader validates the issuer's cryptographic signature and the device binding. Under ISO/IEC 18013-5 this can happen offline, with no live connection to the issuer at the moment of the check.

What "verifying an mDL" actually means

You are answering two questions: is this credential genuine and unaltered, and does it belong to the person presenting it? Because an mDL is signed by the issuing authority, a conformant reader can confirm authenticity from the signature alone — it does not need to phone the issuer. For background, see what is an mDL.

The point-of-sale flow (ISO/IEC 18013-5)

1. Device engagement — the reader shows (or scans) a QR code to establish a secure local session.
2. Request — the reader asks for only the fields it needs (for age-restricted sales, often just "over 18" and a portrait), applying data minimisation.
3. Consent & transfer — the holder approves, and the wallet sends the signed response over Bluetooth Low Energy or NFC.
4. Validate — the reader checks the issuer's signature, the certificate chain (trusted issuer), and device binding, then displays the verified fields.

Online vs offline

In-person verification under 18013-5 works offline. If you need to verify the same credential remotely — in a web or app flow — that's the online counterpart, ISO/IEC 18013-7. See ISO 18013-5 vs 18013-7.

What you need

• An ISO/IEC 18013-5 reader or SDK — purpose-built hardware like the TENSAI readers, or the SDK embedded in your own device or app.
• The trust list of issuer certificates so the reader knows which issuers to trust.
• A request configured for data minimisation — ask only for what the transaction requires.

The Smart Solutions mDL stack and TENSAI readers implement this end to end.

Frequently asked questions

Does mDL verification need an internet connection?

Not for in-person checks under ISO/IEC 18013-5 — trust comes from the issuer's signature, so the reader can validate offline. Online verification (18013-7) is connected by definition.

How does the phone talk to the reader?

A QR code starts a secure session, then the signed data transfers over Bluetooth Low Energy or NFC — a local channel, not the open internet.

Can I ask only for a person's age?

Yes. Data minimisation is a core feature — for an age-restricted sale the reader can request just an "over 18" attribute and a portrait, without exposing the full licence.

What hardware do I need?

An ISO/IEC 18013-5 reader or SDK. Purpose-built readers such as the TENSAI range handle the QR, Bluetooth/NFC and signature validation for you.