Face Match: Comparing the Selfie to the ID Photo, Privately

Liveness proves a real person is present. It does not prove that person owns the document they submitted. That link is the job of 1:1 face match: comparing the selfie captured during onboarding against the portrait printed or chip-stored on the ID. Get it wrong and you either wave through impostors or reject legitimate customers. This is general information, not legal advice, but the engineering trade-offs are worth spelling out.

What a 1:1 match actually measures

A face-match engine converts each image into a numeric vector — an embedding, typically 128 to 512 dimensions — and computes a similarity score. It is not looking for an exact pixel match; it estimates whether two faces belong to the same person despite lighting, angle, and age differences.

Two error rates govern the outcome:

• False Match Rate (FMR): how often two different people are accepted as the same. Tighten this and impostors get through less often.
• False Non-Match Rate (FNMR): how often the same person is wrongly rejected. Loosen the threshold and genuine users pass more easily.

These move in opposite directions. A threshold set for FMR of 1 in 10,000 might push FNMR to 3–5% on low-quality inputs. NIST's FRVT reports show top algorithms achieving FNMR below 0.5% at an FMR of 1 in 100,000 on clean data — but field conditions rarely match the lab.

Where matches fail

Most failures trace to input quality, not the algorithm. Common culprits:

• Degraded reference images: a laminated ID photo scanned at 200 dpi carries far less signal than the NFC chip portrait, which is why chip reads improve match confidence.
• Age gap: a passport issued eight years ago against a current selfie widens the distance between embeddings.
• Demographic differential: FRVT has documented higher FNMR for some groups depending on the training set. Monitor per-cohort rates rather than a single global number.
• Presentation angle and occlusion: glasses, glare, headwear, and off-axis capture all inflate distance scores.

Rather than a hard binary, configure three bands: auto-pass above a high score, auto-fail below a low score, and a manual-review zone between them. Sending the 5–10% of ambiguous cases to a human keeps FMR low without punishing legitimate users caught by a bad photo.

Privacy engineering: templates, not albums

Face images are biometric data — special-category personal data under the GDPR and covered by laws like Illinois BIPA. The safest posture is to treat the raw selfie as transient. A workable pattern:

• Capture the selfie and document image, compute embeddings, run the comparison, and record only the score and decision band.
• Discard raw images on a short timer once the match resolves, unless a specific AML retention rule requires keeping the evidence.
• If you must store templates, encrypt them separately from identity records so a single breach cannot re-link a face to a name.

Data minimization is not just hygiene — it shrinks the blast radius. A leaked similarity score of 0.82 is far less damaging than a leaked photo. Configurable retention lets you keep proof of the decision for the audit window your regulator expects while purging the underlying biometrics.

Running face match in a chat flow

Chat-based onboarding fits this model well. In a Telegram or WhatsApp flow, the user photographs their ID, then takes a guided selfie in the same conversation. Both images stay inside the verification pipeline; the comparison runs server-side; the chat surfaces only pass, fail, or "we need a clearer photo."

Practical guidance for deployment:

• Prompt for retakes when image quality metrics (blur, exposure, face size) fall below threshold — before running the match, not after a rejection.
• Pair face match with liveness so a static photo of a stolen ID cannot satisfy both checks.
• Log the score, threshold version, and model version for every decision, so an auditor can reconstruct why a case passed or went to review.

Done right, 1:1 face match closes the gap between "a real person is here" and "this document belongs to them" — without turning your database into a face archive.