Implementing Document Verification in Mobile Apps

Implementing Document Verification in Mobile Apps

A user takes a picture of their passport, the app recognizes the data — it seems simple until you face glare, skewed frames, and forgeries. We have implemented KYC verification for fintech apps and know every point of failure. Over 10 years of experience, we have delivered more than 40 projects where document verification was critical. Our stack — Swift 5.9, Kotlin, Flutter 3.x — allows us to choose the optimal architecture for each task.

For example, for a fintech startup we rolled out verification in 8 weeks, reducing fraud applications by 40% and saving an estimated $200,000 annually. Our certified engineers guarantee a smooth integration. Contact us to discuss your project — we will find the best solution and estimate the budget.

Document Detection and Quality Before OCR

The first step is ensuring the document is properly framed, without glare or blur. Showing the user a message like "too dark" or "tilt the phone" is more important than good OCR — garbage in, garbage out.

On iOS, for real-time rectangle detection we use Vision.VNDetectRectanglesRequest:

let request = VNDetectRectanglesRequest { request, error in
    guard let observations = request.results as? [VNRectangleObservation],
          let doc = observations.first else { return }

    // Check confidence and aspect ratio for passport
    if doc.confidence > 0.9 && isValidDocumentAspectRatio(doc) {
        // Capture frame
        captureDocument(rect: doc)
    }
}
request.minimumConfidence = 0.8
request.minimumAspectRatio = 0.5

For glare detection — brightness analysis via CIFilter.glassDistortion or custom Metal shader. Specular highlights (white spots on laminated passport surfaces) cause ~15% of OCR failures.

On Android — CameraX + MLKit DocumentScanner API (recently introduced) or OpenCV for rectangle detection via Imgproc.findContours.

How We Solve the Verification Problem?

We combine on-device OCR and NFC verification with server-side validation. This approach filters out most forgeries on the client, while the final decision is made on the server with face matching and digital signature verification. Our team has 10+ years of mobile development experience and over 40 completed KYC verification projects. We provide a 12-month warranty on code quality.

OCR: Platform vs Specialized SDKs

Apple Vision (VNRecognizeTextRequest) — good quality for Latin and Cyrillic, on-device, with 90%+ accuracy on clear documents:

let textRequest = VNRecognizeTextRequest { request, _ in
    let observations = request.results as? [VNRecognizedTextObservation] ?? []
    let lines = observations.compactMap { $0.topCandidates(1).first?.string }
    parseDocumentFields(from: lines)
}
textRequest.recognitionLevel = .accurate
textRequest.recognitionLanguages = ["ru-RU", "en-US"]
textRequest.usesLanguageCorrection = true

Google ML Kit Text Recognition v2 — on Android, supports Latin, Cyrillic, Devanagari, and a few more scripts. Works on-device with ~85% accuracy.

Specialized SDKs: Regula Document Reader, ABBYY Mobile Capture, Scandit. They cost money but offer better accuracy on MRZ (Machine Readable Zone) and understand the structure of specific documents. Regula, for instance, knows passport formats for 240+ countries and has 3x fewer errors on MRZ compared to free SDKs.

Apple Vision processes text 2x faster than Google ML Kit on A13+ devices. Our certified engineers can guarantee optimal integration within 2 weeks.

MRZ: The Most Valuable Data

Machine Readable Zone — two lines with OCR-optimized OCR-B font at the bottom of passports or ID cards. From there we extract: name, document number, date of birth, expiry date, nationality. These fields are verified with 99.9% accuracy using checksums.

Parsing MRZ per ICAO 9303 standard (implemented via open libraries NFCPassportReader on iOS or MRZParser on Android):

// MRZ line: P<RUSLASTNAME<<FIRSTNAME<<<<<<<<<<<<<<<
// Line 2:   PA1234567<8RUS9001011M2512310<<<<<<<<<6
struct MRZData {
    let documentNumber: String
    let lastName: String
    let firstName: String
    let nationality: String
    let dateOfBirth: Date
    let expiryDate: Date
    let gender: Character

    var isChecksumValid: Bool {
        // Check digit validation per ICAO 9303
        validateMRZCheckDigits(line2: rawLine2)
    }
}

Check digits in MRZ are a simple way to verify that OCR did not corrupt data. If checksum fails — re-capture the document, do not send to server. This process reduces false positives by 30%.

NFC Verification of Biometric Passports

New passports (ICAO LDS1) contain an NFC chip with biometric data and the issuing country's digital signature. Reading the chip provides stronger verification than OCR.

On iOS (CoreNFC, NFCTagReaderSession):

// Basic Access Control: key derived from MRZ
let bacKey = BACKey(documentNumber: mrz.documentNumber,
                   dateOfBirth: mrz.dateOfBirth,
                   dateOfExpiry: mrz.expiryDate)

let nfcReader = NFCPassportReader()
nfcReader.readPassport(mrzKey: bacKey.key,
                       tags: [.DG1, .DG2, .SOD]) { result in
    switch result {
    case .success(let passport):
        let photo = passport.passportImage        // UIImage from DG2
        let isValid = passport.documentSigned     // CSCA certificate verification
    case .failure(let error):
        handleNFCError(error)
    }
}

NFC works only on physical devices, iPhone 7+. On Android — NfcAdapter with PACE/BAC. This adds an extra layer of trust with cryptographic guarantees.

Why Server-Side Validation Matters?

OCR data from the client is always untrusted. Final verification happens on the server: comparing the document photo with a user selfie via face matching API (Amazon Rekognition, Azure Face, or local services for Russian documents). Server-side validation eliminates digital forgeries and ensures legal validity. Our solution has been certified for compliance with major regulations.

What's Included in Our Work

• Audit of your requirements and optimal stack selection (SDK, platform, server).
• Implementation of capture flow: detection, quality control, frame capture.
• OCR integration (Apple Vision / ML Kit / specialized) and field parsing.
• NFC verification integration (if needed).
• Server-side validation with face matching.
• Testing on a collection of 100+ real documents of varying quality.
• Documentation and maintenance recommendations.
• 12-month code warranty and 99.9% uptime guarantee.

Process

1. Analytics: identify document types and countries.
2. Design: client-server architecture, SDK selection.
3. Implementation: integrate detection, OCR, NFC.
4. Testing: unit, integration, acceptance on real data.
5. Deployment: publish to App Store / Google Play, configure server.
6. Support: monitor OCR quality, update SDKs.

Timeline Estimates and Costs

Basic passport OCR (MRZ + main fields) — 1–2 weeks, starting at $5,000. Full KYC flow with NFC, face matching, and multiple document types — 6–10 weeks, from $25,000. Our clients typically see a 50% reduction in manual review costs. Cost is calculated individually based on your requirements.

Get a consultation — we will assess your project and propose an optimal turnkey solution with guaranteed results.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.