- Insights
Verify the traveller, not a photo of their passport
Travel fraud starts with an identity that can’t be trusted. Here’s how verifying the traveller with eIDs and wallets stops it.
ㅣ
Kelly Soudan
ㅣ
3 min read
Travel fraud rarely looks like fraud at the moment it happens. A booking made with a stolen card. A promo code used by the same person under ten names. A guest who isn’t the person who booked. A host account taken over just long enough to change the payout details. A car collected by someone other than the renter. Each one starts with an identity that nobody could really check.
Why document checks are losing ground
Most travel platforms that verify identity today ask for a photo of an ID document and a selfie. That raised the bar a few years ago. Now the tools to beat it are cheap and widely available: edited document images, deepfaked selfies and injection attacks that feed fake camera input straight into the verification step. iProov reports a 741% rise in iOS injection attacks on identity verification in 2025. Camera-based checks are under attack.
What changes with government-anchored identity
A government eID or wallet credential is different in kind. The data is signed by the issuing government, or matched against the government’s own database. There’s no photo to edit and no camera feed to inject into. If the signature doesn’t verify, the credential fails.
That gives trust and safety teams a different starting point:
At booking: bind the booking to a verified person, not just a card and an email address.
At check-in or pickup: confirm the person arriving is the person who booked.
At promotions and sign-up: limit offers to one verified person, not one email address.
At partner and host accounts: re-verify the account owner before bank or payout details change.
Each eID has a different assurance level and suitability for KYC. Hopae publishes this per scheme, so your team knows exactly what each verification is worth.
Trip.com: identity from the first step
Trip.com uses Hopae to accept verified wallet credentials at flight booking. The booking is built on data issued by a government rather than typed from memory. That’s a better start for every later step, including the checks that protect against fraud. As the Trip.com case study notes, the same credentials can extend to check-in, visas and biometric boarding.
“Digital identity is a key enabler of a more seamless travel experience.” Nick Careen, SVP Operations, Safety and Security, IATA
Trip.com also added this without removing anything. Wallet identity is an option inside the existing flow. For trust and safety teams, that’s the model: offer government-anchored identity first, and keep your current document check as the fallback for travellers who don’t have an eID. Read the case study.
Less friction, not more
Fraud controls usually cost conversion. This one doesn’t have to. Sharing a wallet credential takes a tap. Photographing a document and taking a selfie takes several steps and often several attempts. Stronger verification and a faster flow can come from the same change.
Passport-grade trust on the phone
The strongest identity document most travellers own is the passport chip. Its data is signed by the issuing state, and border systems check that signature against ICAO’s public key infrastructure. ICAO’s Digital Travel Credential brings the same signed data to the phone: a Type 1 credential is created by reading the passport chip, and Types 2 and 3 are issued directly by the passport authority.
For trust and safety teams, the trust chain doesn’t change. The credential is verified against the issuing state’s signature, not judged from a photo. Formats such as ISO/IEC TS 23220-4 (Photo ID) and ISO/IEC 18013-5 carry that signature into mobile wallets, and IATA’s proofs of concept, including Hopae’s work with the Photo ID format, have tested them in travel journeys. Platforms that verify government eIDs now will verify digital passports the same way when they arrive.
Where to start
Find the point where fraud costs you most: booking, promotions, check-in, pickup or partner payouts.
Check which eIDs your highest-risk segments already carry.
Add government-anchored identity there first, with your current check as the fallback, and compare chargebacks, claims and manual reviews.
Talk to Hopae about adding government-anchored identity where fraud costs you most.
Sources:
Trip.com plans digital ID pilot using Google and Apple wallets - Phocus Wire
AI and Digital Identity Drive Aviation’s Next Chapter: Trip.com Group at Airline Global Conference - PR Newswire
