What is a mobile driver licence (mDL)? ISO/IEC 18013-5, explained

Ask most people what a mobile driver licence is. They will guess it is a photo of a card, saved to a phone. It is not. An mDL is a digitally signed credential, issued by government, held in a phone wallet.

The standard behind it is ISO/IEC 18013-5, published in 2021. This guide explains how it works and why it matters. It is written for people who run venues, banks, rental counters and government services. No cryptography background needed.

What an mDL actually is

An mDL bundles two things. The first is your licence data: name, date of birth, photo, licence classes. The second is a digital signature from the issuing authority, covering that data.

The wallet app holds both on the device. During a check, a reader receives the data and the signature together. It verifies the signature against the issuer's published public key. If anything in the data was changed, the check fails.

The credential is also tied to the phone itself. During provisioning, the wallet generates keys inside the device's secure hardware. The issuer signs over those keys, binding the licence to the phone. This is called device binding, and it is designed to defeat cloning.

A screenshot cannot pass these tests. Neither can a scan, a PDF or a photo of the plastic card. Only the intact, signed credential verifies.

The trust triangle

Every mDL check involves three roles. ISO/IEC 18013-5 defines how they interact.

• Issuer: a licensing authority signs the credential and provisions it to the wallet.
• Holder: the licence owner keeps the credential on their phone and decides when to share it.
• Verifier: a venue, bank or agency reads the data and checks the signature.

Notice what is absent: no live call to the issuer during the check. The verifier only needs the issuer's public key, which it can fetch in advance. Checks are therefore designed to work offline, at a festival gate or in a basement bar.

This design has a privacy benefit too. Because there is no call home, the issuer does not learn where the licence was presented.

How a presentation works

A standards-based check takes seconds. Here is the flow, step by step.

• Engagement: the holder shows a QR code or taps the reader using NFC. This exchange shares connection details only, never licence data.
• Consent: the wallet shows what the verifier is asking for. The holder approves with a PIN, fingerprint or face unlock.
• Transfer: the requested data moves to the reader over an encrypted local connection, typically Bluetooth Low Energy.
• Verification: the reader checks the issuer signature and confirms the credential belongs to that specific device.

The phone never leaves the holder's hand. The verifier never rummages through a wallet, digital or physical. Both sides finish the check faster than they would with a card.

Selective disclosure, in one paragraph

An mDL can share some fields and withhold the rest. A venue can request an "over 18" answer and a photo, nothing more. Name, address and licence number stay on the phone, and the partial response still verifies. See our age verification use case for how this plays out at the door.

Why an mDL beats a plastic card

Plastic cards were built for human eyes. Holograms and microprint help, but convincing fakes are now cheap to buy. An mDL is built to be checked by machines, which changes the economics of fraud.

• Tamper-evident: any edit to the data breaks the issuer signature, and the reader flags it.
• Clone-resistant: the credential is bound to keys inside the phone. A copied file is designed not to verify on another device.
• Always current: issuers can update or revoke a credential remotely, keeping data far fresher than a printed card.

A fake card only has to fool a busy human at midnight. A fake mDL has to defeat cryptography. No technology removes risk entirely, but that is a much better starting position.

What an mDL is not

An mDL is not a replacement for the plastic card. In the Australian schemes running today, the card remains valid and the digital version is optional.

It is also not a tracking tool. The in-person protocol is designed to work without the internet and without notifying the issuer. Sharing happens only when the holder consents on their own device.

18013-5 and 18013-7, in plain words

ISO/IEC 18013-5 covers in-person checks. Holder and verifier are in the same place, and data moves directly between devices. This is the standard for doors, counters and roadside checks.

ISO/IEC 18013-7 extends the same credential to online use. It defines how a wallet presents licence data to a website or app over the internet. Think remote bank onboarding, or confirming a driver before a car hire booking. Same signatures, different channel.

For verifiers, the practical takeaway is simple. One credential can serve both in-person and online channels.

Where adoption stands

In the United States, many states now issue mDLs. AAMVA, the association of North American licensing authorities, publishes implementation guidelines built on ISO/IEC 18013-5. Its Digital Trust Service gives verifiers one place to fetch issuer public keys. Adoption stages vary, from early pilots to full production programs.

Australian states moved early. The NSW digital driver licence carries the same legal status as the card within NSW. Queensland's Digital Licence app was built to align with ISO/IEC 18013-5. South Australia offers digital licences and proof-of-age passes through its state app.

Europe is heading the same way. The eIDAS 2.0 framework requires member states to offer citizens digital identity wallets by the end of 2026. Driving licences are among the credentials those wallets are expected to carry.

Schemes differ in maturity and technology. The shared destination is clear: signed, verifiable credentials on phones, checked against open standards.

Getting ready to verify

If your organisation checks IDs at scale, mDLs will reach you soon. Accepting them well requires hardware and software that implement the standard faithfully.

That is the problem Smart Solutions works on. Our TENSAI readers and SDK are designed to verify credentials to ISO/IEC 18013-5, from engagement through to signature checks. To see how they fit venues, branches and rental counters, start with our mDL verification page.