Driver verification in Mexico: ID, face, address

How it works

Three photos from your user. Three waves of verification.

Fraud in car rental is almost always impersonation: a borrowed identity or someone else's ID. Here's how the full verification comes together: each wave uses the previous one's response. You fire the calls and OrigoID answers; the cross-checks between responses are an if in your backend.

OrigoID serviceYour code

Your user

Front of their INEFrom their phone.

Back of their INEFrom their phone.

A selfieThat's where their part ends.

+ CSF, if you invoiceOr just RFC + CIF.

Wave 1 · in parallel

Reads the INE and returns the address ready to useOCR of front and back. The printed address comes in dirty —abbreviations, no neighborhood—; most OCRs hand it to you as-is. OrigoID returns it normalized and split into fields: addressNormalized.OCR INE

Cross-checks the back against the printed sideFrom the back we extract the document data and the holder's face, and compare them against what the OCR read. Two independent readings that must match.INE QR

Compares the selfie against the IDThe selfie's face against the photo on the INE: score 0–100 with a configurable threshold.Face Match

Wave 2 · with the OCR response

You cross-check the two responsesName, CURP and ID keys from the OCR against those on the back: they must match. It's an if in your backend — both responses are already in your hands.your code

Compares the face on the front with the one on the backYou send the two photos OrigoID returned —the one from the OCR and the one from the back— and get the score: the same person on both sides of the ID.Face Match

Validates the CURP and generates the RFCThe extracted CURP is validated against RENAPO and, in the same call, the driver's RFC is generated. See Validate CURPCURP validation

Confirms it's current in the rollWith the ID keys the OCR read: it exists and is current in the INE's Lista Nominal.Lista Nominal

Wave 3 · with the RFC

Extracts the tax certificateFrom the CSF (or with RFC + CIF) you get the tax regime, the status and the taxpayer's RFC, already structured.SAT CSF

You cross-check the RFC from both sourcesThe RFC on the certificate must match the one generated from the CURP. Two sources, one true value — another if in your backend.your code

A value doesn't match?

The envelope tells you exactly what failed —FACE_MISMATCH if the face isn't the one on the ID, IMAGE_UNREADABLE if the photo came out blurry, a back that doesn't line up with the front— and you ask for just that photo or that value again. The rest of the flow doesn't repeat, and the legitimate driver passes without friction.

Raw infrastructure · 100% REST API

From document to decision, in one call.

You send the INE image; you get the data already structured and the address already split into fields in the same envelope as every endpoint. Learn the contract once and it works for every step of the flow.

One envelopeThe same JSON —status, type, data— across INE, QR, face, Lista Nominal, CURP and CSF.

Address ready to useMost OCRs give you the address exactly as printed. OrigoID delivers it split into fields and validated against the catalog, with no extra step on your side.

No data retentionThe ID and the face are used only to validate and discarded on response, without storing the data.

Read the docs ↗

verificar-conductor
          
          
          
        
const res = await fetch("https://api.origoid.com/mex/id/v1/voter-id-extractions", {
  method: "POST",
  headers: {
    "x-api-key": process.env.ORIGOID_API_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({ front: ineFrontBase64 }),
});

const result = await res.json();import os, requests

res = requests.post(
    "https://api.origoid.com/mex/id/v1/voter-id-extractions",
    headers={
        "x-api-key": os.environ["ORIGOID_API_KEY"],
        "content-type": "application/json",
    },
    json={"front": ine_front_base64},
    timeout=30,
)
result = res.json()curl -X POST https://api.origoid.com/mex/id/v1/voter-id-extractions \
  -H "x-api-key: $ORIGOID_API_KEY" \
  -H "content-type: application/json" \
  -d '{"front": "<base64 of the INE (JPG or PNG)>"}'Response with the data already extracted
{
  "status": "OK",
  "type": "SUCCESS",
  "data": {
    "documentType": "INE",
    "personalInfo": { "givenNames": "ANA SOFIA", "curp": "GOSA880718MNLNLN07", … },
    "addressNormalized": {
      "geocodingStatus": "VERIFIED",
      "street": "Avenida Lago Alberto", "zipCode": "11320",
      "municipality": "Miguel Hidalgo", "state": "Ciudad de México"
    }
  },
  "billable": true
}

Frequently asked

What people usually ask us.

What do I need to verify a driver?

Your user takes three photos: the front and back of their INE, and a selfie. With that you run the OCR with a normalized, catalog-validated address, the read of the back, the face comparisons, Lista Nominal and the CURP and RFC cross-check against RENAPO and SAT — each response feeds the next call.

How do I know the INE isn't fake?

It's the sum of the layers: the data the OCR read is cross-checked against what's extracted from the back —two independent readings that must match—; the face pulled from the front is compared against the one on the back; and Lista Nominal confirms the ID exists and is current in the INE's roll. A tampered ID fails at one of those layers.

Does OrigoID validate the driver's license?

It's on our roadmap, with no committed date yet. Today we verify the driver's identity —INE, QR, face, CURP, RFC—, which is the layer that prevents most impersonation fraud in car rental.

What happens if a value doesn't match?

The envelope tells you exactly what failed —FACE_MISMATCH, IMAGE_UNREADABLE, a back that doesn't line up with the front— and you ask for just that photo or that value again. The rest of the flow doesn't repeat.

Do you store my users' data?

No. Every query is validated, answered and discarded, without storing the data.

Verify your driver is who they say they are.

Three photos from your user. Three waves of verification.

From document to decision, in one call.

Your customers' sensitive data, treated as such.

What people usually ask us.