Vietnam ID card verification: reading the CCCD chip with NFC
How to verify Vietnam's chip ID card (CCCD and the 2024 thẻ căn cước): what the chip holds, NFC reading, passive authentication, liveness and face match, failure modes, and where it sits next to VNeID.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
Vietnam ID card verification works best from the chip: the citizen identity card (CCCD) has carried a chip since 2021, and the identity card issued since 1 July 2024 stores the holder's name, personal identification number, date of birth and face image in it to the International Civil Aviation Organization (ICAO) standard.[2][3] A phone with near-field communication (NFC) can read the chip, check the issuer's signature and compare the chip photo with a live selfie.
- A chip check shows the chip data was signed by the issuer and not altered;[9] liveness and face match check that a live person matching the portrait is present.
- Decree 320/2026/ND-CP asks listed platforms to link accounts with an e-identification account (VNeID); existing non-bank accounts have until before 31 December 2026.[5]
- A chip check does not replace that link. It covers users without VNeID and checks the card behind the account.
Vietnam ID card verification used to mean a photo of the card and a selfie. Every identity card issued since 1 July 2024 carries a chip whose core identity fields follow the ICAO standard used for e-passports.[2] Since the same date, the State Bank of Vietnam has listed a match between a customer's biometrics and the CCCD chip as one way to authenticate certain online payments.[7]
This guide shows product and compliance teams how to check the card from its chip, what to do when the chip cannot be read, and where that check sits next to the VNeID link that Decree 320/2026/ND-CP now requires.
Vietnam's chip ID card at a glance
| Item | What the rules say | Where |
|---|---|---|
| Name | "Thẻ căn cước" (identity card) since 1 July 2024; earlier CCCD cards stay valid until their printed expiry[1] | Identity Law, Art. 45 and 46 |
| Holders | Vietnamese citizens; mandatory from age 14, on request below 14[1] | Identity Law, Art. 19 |
| Renewal | At ages 14, 25, 40 and 60[1] | Identity Law, Art. 21 |
| Back of the card | Chip, QR code and machine-readable zone (MRZ)[2] | Circular 16/2024/TT-BCA, Art. 3 and 6 |
| Chip, ICAO part (2024 card) | Full name, personal ID number, nationality, date of birth, sex, expiry, place of origin, face image[2] | Circular 16/2024/TT-BCA, Art. 6(3)(a) |
| Chip, encrypted part (2024 card) | Fingerprints, iris, ethnicity, religion, blood type and other fields[2] | Circular 16/2024/TT-BCA, Art. 6(3)(b) |
| Issuer | Ministry of Public Security (MPS)[1][2] | Identity Law, Art. 18(2) |
Try it on your own flow
Read a Vietnamese ID card chip, run liveness and compare faces in a test workflow: Start free, or Talk to us about your Vietnam onboarding.
CCCD, căn cước and the 2024 rename
Most people still say CCCD (căn cước công dân, citizen identity card). The Identity Law 2023, Law 26/2023/QH15, replaced the 2014 Law on Citizen Identification from 1 July 2024 and renamed the document "thẻ căn cước".[1] Cards already issued were not cancelled: a CCCD stays valid until the expiry date printed on it.[1] Older ID cards (chứng minh nhân dân) whose validity ran past 2024 stopped being valid at the end of 31 December 2024.[1]
- 23 January 2021Chip CCCDCircular 06/2021/TT-BCA puts a chip on the back of the CCCD.[3]
- 1 July 2024New cardIdentity Law, Circular 16/2024 and Decree 69/2024 take effect.[1][2][4]
- 31 December 2024Old ID endsThe last chứng minh nhân dân cards stop being valid.[1]
- 28 September 2026Decree 320Decree 320, with its account-linking rule, takes effect.[5]
- 31 December 2026Linking deadlineExisting non-bank accounts must be linked before this date.[5]
The 2021 CCCD and the 2024 identity card are both in circulation: one document type, two generations.
Two edge cases matter. People of Vietnamese origin whose nationality is undetermined receive a paper identity certificate (giấy chứng nhận căn cước), with no chip to read.[1][2] Foreign residents do not hold the card, which is issued to citizens.[1] For them, reading the passport chip is the practical document route.
What the chip holds, and what a reader can see
The Identity Law gives the card printed information and an encrypted storage component holding the face image, fingerprints, iris and the identity data listed in the law.[1] Circular 16/2024/TT-BCA, the MPS rule on the card format issued since 1 July 2024, splits that storage in two.[2] For the 2021 CCCD, the earlier circular describes a chip storing the citizen's basic information without setting out its encoding.[3]
Article 6(3)(a)Circular 16/2024/TT-BCA
"Thông tin lưu trữ trong chíp điện tử được mã hoá theo tiêu chuẩn ICAO gồm: Họ, chữ đệm và tên khai sinh; số định danh cá nhân; quốc tịch; ngày, tháng, năm sinh; giới tính; ngày, tháng, năm hết hạn; quê quán; thông tin sinh trắc học về ảnh khuôn mặt"
In English: information in the chip encoded to the ICAO standard comprises the full birth name, personal identification number, nationality, date of birth, sex, date of expiry, place of origin and biometric information on the face image. Source: vbpl.vn, Circular 16/2024/TT-BCA[2]
| Storage part | What it holds | What a standard NFC reader gets |
|---|---|---|
| Chip, ICAO part | The eight items above, including the face image[2] | The data, the face image and the issuer's signature |
| Chip, encrypted part | Fingerprints, iris and other fields, under the identity authority's own algorithm[2] | Nothing usable |
| QR code | ID number, name, date of birth, sex, residence, issue date[2] | Readable by a camera; no face image |
Two legal points shape the design. A competent party that asks to see the card may not ask again for information already printed on or integrated into it.[1] And organisations may read the encrypted information integrated into a card with the citizen's consent.[1] Ask for consent before the NFC step, and do not ask for uploads of facts the chip carries.
How passive authentication verifies the chip data
An ICAO chip is opened with a key derived from the card's MRZ (document number, date of birth and expiry date with check digits) under Basic Access Control (BAC), or with Password Authenticated Connection Establishment (PACE).[9] The check that matters next is passive authentication, which ICAO Doc 9303 sets out in five steps.[9]
1Read the Document Security Object
The Document Security Object (SOD) carries a hash of every data group and the Document Signer Certificate.[9]
2Validate the certificate chain
From the Document Signer Certificate up to the issuing country's Country Signing Certificate Authority (CSCA).[9][10]
3Verify the SOD signature
With the verified Document Signer public key.[9]
4Hash each data group
Data group 1 (DG1) holds the MRZ data and DG2 the face image; each hash must equal the SOD value.[8][9]
All hashes and signatures check out
Trust the chip data
Compare it with the printed side, then run liveness and face match.
Retry, then review
Send to manual review; never approve automatically.
Passive authentication, simplified from ICAO Doc 9303 Part 11, section 5.1.
ICAO states the limit plainly: passive authentication "does not prevent exact copying of the contactless IC's content or chip substitution".[9] Active authentication, where the chip supports it, signs a random challenge with a private key that never leaves the chip.[9] A certificate failure is a signal, not a verdict: it "does not on its own cause an eMRTD to be considered invalid" (an eMRTD is an electronic machine-readable travel document).[10] Route it to review.
| Check | What it checks | What it does not prove |
|---|---|---|
| Passive authentication | The chip data was signed by the issuer and not changed[9] | That the chip is not an exact copy[9] |
| Active or chip authentication | The data came from the genuine chip[9] | Who holds the card |
| Chip against printed side | The printed and chip fields agree[9] | That the card is not a counterfeit with a copied chip |
| Liveness | Whether the capture comes from a live person, and signs of photo, mask or replay attacks | Which identity that person has |
| Face match | How similar the live face is to the card or chip portrait | That the card was not reported lost |
Liveness, face match and injection attacks
A genuine card in the wrong hands passes every chip check, so the person step matters. Vietnam's banking rules show the pattern: since 1 July 2024, State Bank Decision 2345/QĐ-NHNN lets banks authenticate certain categories of online payments by matching the customer's biometrics against the data in the CCCD chip, with a solution that verifies the card was issued by the police, or through the customer's e-identification account.[7]
Liveness checks that a live face is present, from one capture or with a movement or light challenge. Face match compares it with the printed portrait or, better, the issuer-signed DG2 face image from the chip.[8][9] Injection detection checks that the camera feed itself is real.
Watch out
Injection attacks skip the camera. A virtual camera, a hooked app or an emulator feeds a recorded or generated face straight into the capture pipeline. Set virtual-camera, frame-injection and screen-capture warnings to trigger review or decline (they often default to no action), and enforce the decision on your server.
Vietnam ID card verification, step by step
Keep the user in one session and the decision on your backend: your server creates a session, the user completes it on a phone, your server reads the result.
Chip read, signature and hashes checked
Simplified. The webhook carries the status; fetch the full decision from your server.
Store the evidence with the account: NFC status, signature and hash results, face match score, liveness result and warnings. If chip and printed data disagree, do not approve.
When the chip cannot be read
Read failures come from devices, card positioning or damaged chips as well as fraud: check the reported cause before deciding.
| Situation | What happens | What to do |
|---|---|---|
| No NFC on the phone, or NFC off | The chip step cannot start | Prompt to turn NFC on; else use photos, liveness and face match, and flag the account |
| Card moved during the read | The access step or the read fails | Show where the chip sits and retry |
| Damaged chip | Repeated read failures | Use the document route; re-check after replacement |
| Issuer certificate not available | No trust anchor for the signature | Review, not decline |
| Chip and print disagree | Data mismatch warning | Decline or escalate |
| Browser on an iPhone | Safari gives web pages no NFC | Use a native SDK or app |
| Foreign user | No Vietnamese card | Read the passport chip |
| Identity certificate holder | Paper document, no chip[2] | Document route or manual review |
Where the chip check sits next to VNeID and Decree 320
Decree 320/2026/ND-CP of 13 August 2026 amends Decree 69/2024/ND-CP on electronic identification and authentication and took effect on 28 September 2026.[5][6] Its new Article 40(9) says electronic transaction accounts on digital platforms in twelve listed fields, from education, securities, telecoms and banking to e-commerce sellers, livestream sellers and affiliates (see our seller verification guide) and social networks in Vietnam, must be linked and authenticated with an e-identification account.[5][6] Accounts in those sectors created before 28 September 2026 have until before 31 December 2026, or before 30 June 2027 for banking.[5] The decree names no other method, and its text contains no penalty clause.[5] Details: our Decree 320 guide.
What the decree asks
Link to an e-identification account (VNeID)
- Required for accounts in the listed fields; for cross-border services, only once those platforms meet the conditions and are connected[5]
- Runs through the MPS system and the providers it licenses[4][5]
- Uses the user's own VNeID account; foreigners can also be issued one[4][5]
Decree 69/2024, Art. 40(9), added by Decree 320/2026
What a chip check adds
Chip-checked card with liveness and face match
- Shows the card data is genuine and a live face matches it
- Works for users who have not linked VNeID yet
- Does not by itself meet the linking duty
Identity Law 2023; ICAO Doc 9303[1][9]
Decree 69/2024 gives a yardstick: four authentication levels, the highest combining a biometric factor, something held such as the identity card, and something known, against which organisations classify their own checks.[4] In that frame, a chip read supplies the possession factor and a face match on a live capture the biometric one. A level 4 check also needs a factor the user knows. And when handling administrative procedures, public services and transactions, the Identity Law says the electronic identity is used where it differs from the card.[1]
Talk to us about Vietnam
Didit does not run VNeID today; access to VNeID authentication runs through the MPS system and the providers it licenses. If your platform needs VNeID, talk to us about connecting it through the same workflow. The chip-checked card route works today.
Checklist for product and compliance teams
- Map which account types fall under Decree 69/2024 Article 40(9) as amended.[5]
- Plan the VNeID link: existing non-bank accounts before 31 December 2026, existing banking accounts before 30 June 2027.[5]
- Accept the 2021 CCCD and the 2024 identity card as one document type.[1]
- Ask for consent on screen before reading the chip.
- Run passive authentication against the issuing country's certificate.[9]
- Decline when chip data and printed data disagree.
- Match the live face against the chip portrait.
- Turn on virtual-camera, frame-injection and screen-capture checks.
- Define and mark the fallback for phones without NFC.
- Re-check users whose card expires or reaches a renewal age.[1]
How Didit helps
Didit's ID verification and NFC verification run the card, chip and face steps in one session.
- Vietnam's ID card and passport are on Didit's list of NFC-supported documents.[12] Didit reads the chip on the user's phone, verifies the SOD signature against the issuing country's certificate, checks each data-group hash and compares the chip MRZ with the printed one.[11]
- The NFC report returns the chip portrait (DG2), signature and hash results, and warnings you set to review or decline.[11]
- Passive and active liveness with iBeta Level 1 presentation attack detection, and face match, including a face match API for any two images such as selfie and chip portrait.
- Virtual-camera, frame-injection and screen-capture signals, face search for duplicate accounts, and device and internet protocol (IP) address analysis.
- A flow in Vietnamese, phone checks by SMS or Zalo, software development kits (SDKs) for Web, iOS, Android, React Native and Flutter, and webhooks.
- A full know your customer (KYC) check costs $0.33 and NFC verification $0.15 per check (pricing). Data is processed in the EU by default; in-country processing for enterprise accounts is subject to availability and contract.
Didit's national eID framework runs MitID, BankID Sweden, Finnish Trust Network, Smart-ID and Mobile-ID today; VNeID is not part of it, and platforms that need it can talk to Didit about connecting it.
Didit provides
- Card capture, NFC chip reading and passive authentication
- Liveness, face match and injection signals
- The evidence of every check, by API and webhook
Stays with you
- The VNeID link required by Decree 320
- Consent, retention and personal data duties
- The decision to open, limit or close an account
Check Vietnamese ID cards from the chip
Read the chip, verify the signature and match the face in one flow, then test it on your own sign-up.
Key takeaways
- The CCCD was renamed "thẻ căn cước" on 1 July 2024; older CCCD cards stay valid until their printed expiry.[1]
- On the card issued since 1 July 2024, the chip stores eight identity items, including the face image, to the ICAO standard; fingerprints and iris use the authority's own encryption.[2]
- Passive authentication shows the chip data is signed and unchanged;[9] liveness and face match check that a live person matching the portrait is present.
- Decree 320 requires a link to an e-identification account for listed sectors, before 31 December 2026 for existing non-bank accounts; a chip check does not replace it.[5]
Frequently asked questions
What is a CCCD card in Vietnam?
CCCD (căn cước công dân) is the citizen identity card issued by the Ministry of Public Security, with a chip since 2021.[3] Since 1 July 2024 new cards are called thẻ căn cước, and earlier CCCD cards stay valid until their printed expiry.[1]
Can a phone read the chip on a Vietnamese ID card?
Yes, with an NFC phone and a compatible app. The 2024 card's chip follows the ICAO standard,[2] and ICAO chips open with a key derived from the MRZ (BAC) or with PACE.[9] On iPhones this needs a native app, because Safari gives web pages no NFC.
What data is stored in the CCCD chip?
On the identity card issued since 1 July 2024, the ICAO part holds the full name, personal identification number, nationality, date of birth, sex, expiry date, place of origin and face image.[2] Fingerprints, iris and other fields use the identity authority's own encryption, so a standard reader does not get them.[2]
What is passive authentication?
It is the ICAO check that chip data was signed by the issuing state and not changed: validate the certificate chain, verify the signature on the Document Security Object, and compare each data-group hash.[9] It does not rule out an exact copy of the chip.[9]
Does an NFC chip check replace VNeID under Decree 320?
No. Decree 320/2026/ND-CP requires accounts in the listed sectors to be linked and authenticated with an e-identification account and names no other method.[5] A chip check verifies the signed chip data, and liveness and face match assess the person presenting it; these checks do not replace the required account link.
What is the deadline for linking existing accounts to VNeID?
Accounts in the listed sectors created before 28 September 2026 must be linked before 31 December 2026; banking accounts created before that date have until before 30 June 2027.[5]
What happens if a user's phone has no NFC?
The chip step cannot run. Fall back to photos of both card sides with liveness and face match, mark the account as not chip-checked, and ask for a chip read later.
Do foreign users have a CCCD?
No, the card is issued to Vietnamese citizens.[1] Foreign users verify with a passport, and they can also be issued an e-identification account.[4][5]
Can Didit connect to VNeID?
Not today. Didit's national eID framework runs MitID, BankID Sweden, Finnish Trust Network, Smart-ID and Mobile-ID. Access to VNeID authentication runs through the Ministry of Public Security's system and the providers it licenses.[4][5] Platforms that need VNeID can talk to Didit about connecting it, and use the chip-checked card route meanwhile.
How much does NFC verification cost with Didit?
NFC verification costs $0.15 per check, and a full KYC check with document, liveness, face match and IP analysis costs $0.33.
Sources
- Identity Law (Luật Căn cước) No. 26/2023/QH15, full text, Government of Vietnam policy portal, passed 27 November 2023, Articles 18 to 22, 33, 45 and 46.
- Circular 16/2024/TT-BCA on the identity card and identity certificate formats, Ministry of Public Security, 15 May 2024, Articles 3, 6, 8 and 9.
- Circular 06/2021/TT-BCA on the citizen identity card format, Ministry of Public Security, 23 January 2021, Articles 3 and 4.
- Decree 69/2024/ND-CP on electronic identification and authentication, Government of Vietnam, 25 June 2024, Articles 3 and 20.
- Decree 320/2026/ND-CP amending Decree 69/2024/ND-CP, Government of Vietnam legal documents portal, 13 August 2026, Articles 3, 10, 19 and 20.
- Decree 320/2026/ND-CP, full Vietnamese text, LuatVietnam.
- Decision 2345/QĐ-NHNN on security solutions for online payments and bank cards, State Bank of Vietnam, 18 December 2023, Article 5 and appendix.
- ICAO Doc 9303, Part 10: Logical Data Structure, International Civil Aviation Organization, eighth edition, 2021.
- ICAO Doc 9303, Part 11: Security Mechanisms for MRTDs, International Civil Aviation Organization, eighth edition, 2021, sections 4.3, 5 and 6.
- ICAO Doc 9303, Part 12: Public Key Infrastructure for MRTDs, International Civil Aviation Organization, eighth edition, 2021, section 2.
- NFC verification report, Didit documentation.
- NFC-supported documents, Didit documentation.
Vietnam's card already carries a signed chip. See NFC verification, ID verification and eID verification.
Onboard Vietnamese users on evidence you can show
Start with the chip, the face and the signed result, and talk to us about the rest of your Vietnam plan.
Related articles
- Vietnam e-commerce law: KYB for sellers, livestreamers and affiliates
- Decree 320/2026: VNeID account verification for platforms in Vietnam
- MiCA regulation in 2026: the EU crypto compliance guide to 2028
- Companies House identity verification: Insolvency Service convictions
- Privacy coin regulation after FinCEN drops its mixing rule
- OSC Argosy decisions: KYC risk tolerance and a suspended UDP