ISO/IEC 18013-5:2021 is the international standard for mobile driving licences presented from a digital wallet or similar device. It defines the data model, security features and verification process for issuing, storing and checking the credential, including cryptographic protection and reader authentication.
What ISO/IEC 18013-5:2021 Defines
ISO/IEC 18013-5:2021 is not just a format for showing a mobile driving licence, it defines how the credential is structured, protected and verified when it is presented from a digital wallet or similar device. That makes it a full interoperability and trust standard, covering the credential data model, security features and the verification flow between issuer, holder device and reader.
Its value is that it turns a wallet-held licence into something relying parties can check in a consistent way. Without that common model, each issuer or wallet could invent its own presentation behaviour, which would undermine acceptance, reader compatibility and assurance.
How Mobile Driving Licence Verification Works
The standard is built around a proof-oriented presentation model. The holder device presents selected data from the mDL, the reader checks the presentation, and the exchange relies on cryptographic protection so the relying party can detect tampering or replay. A practical implementation often depends on complementary profiles and ecosystem rules, which is why NHIMG’s Mobile Driving Licence (mDL) Guide is useful for readers who need the broader issuing and verification context.
The verification process also depends on reader authentication. That matters because the holder should only disclose credential data to a legitimate verifier, not to any nearby device that can initiate a request. In other words, the standard is as much about controlled disclosure as it is about display of identity data.
Security and Trust Properties
The security model is designed to protect the credential while it is stored on-device and when it is transmitted for verification. Cryptographic protection helps ensure integrity, origin assurance and resistance to straightforward cloning or alteration, while reader authentication reduces the chance that an attacker can impersonate a legitimate verifier and harvest data.
The standard also helps establish trust boundaries in a highly portable form factor. A wallet-based credential is exposed to risks that paper cards do not face, including device compromise, interface abuse and unlawful data capture during presentation. The standard’s security features exist to reduce those risks, not eliminate them entirely.
Where the Standard Fits in Digital Identity Systems
ISO/IEC 18013-5:2021 sits at the intersection of identity proofing, credential issuance and real-time verification. It is especially relevant where organisations want a verifiable government-issued credential in a mobile form factor that can be checked by service desks, age-verification points, transport operators or other relying parties.
For practitioners, the important point is that the standard does not replace policy decisions about when a licence should be accepted, what attributes should be disclosed, or how the surrounding wallet ecosystem is governed. It defines the technical presentation layer, while the deployment still depends on issuer policy, verifier trust decisions and operating procedures.
Risk and Threat Considerations
Mobile driving licences reduce some fraud paths, but they also concentrate trust in the device, wallet and reader ecosystem. If a wallet, reader or presentation flow is weakly implemented, an attacker may try to intercept, replay, spoof or coerce credential presentation, or use a compromised device to expose more data than intended.
Failure mechanism: Breakdowns usually come from weak reader authentication, poor cryptographic implementation, device compromise or overbroad disclosure at presentation time.
Impact: The result can be forged verification, unauthorised access to personal data, failed identity checks or loss of confidence in the credential ecosystem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Service Organization Users) | Covers machine or service-side authentication that underpins verifier trust in the presentation flow |
| IA-5 — Authenticator Management | Supports lifecycle protection of cryptographic authenticators and presentation credentials | |
| IA-2 — Identification and Authentication (Organizational Users) | Applies where staff or operators access mDL administration or verification systems | |
| Recommendation — Apply IA-9 to authenticate verifier systems before they receive or validate mDL presentations. Manage credential material under IA-5 to control issuance, storage, rotation and revocation. Use IA-2 to require strong user authentication for administrative and verifier access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Sets access-control expectations for systems handling mobile credentials and verifier access |
| A.8.24 — Use of cryptography | Directly supports the standard's cryptographic protection and integrity model | |
| Recommendation — Define and enforce access rules for mDL systems and the data they process. Apply cryptographic controls to protect mDL data in storage and presentation. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Relevant where mDL verification is exposed through API-backed wallet or relying-party services |
| Recommendation — Verify authentication controls on mDL APIs so attackers cannot impersonate trusted participants. | ||
Practitioner Guidance
Why practitioners should care: The standard only works when issuers, wallet providers and relying parties implement it consistently. Treat interoperability testing as part of trust validation, not just technical integration, because verification behaviour can fail silently if the reader, wallet or issuer assumptions do not match.
What to watch for: Pay close attention to reader authentication, disclosure minimisation and the lifecycle of the credential in the wallet. If the surrounding environment cannot reliably prove the verifier, protect the holder device, and validate the presentation flow end to end, the assurance value of the mDL drops quickly.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org