Chinese User Identifications API

According to the legislation of the PRC, registration on any web portal or service requires the user to be identified as a real person. In this article we will discuss how to do this, what is required for this and what consequences it entails.

On May 18, 2004, regulations were issued for the first time to define this. Each user of every web-site must be a real person. Since at that time, due to the level of technological development, this was practically impossible, the first stage of checks was the ordinary requirement to enter the ID-card number and the user's full name. Quite often (especially in terms of applications with critical information or with important services), it is necessary to identify the user with a higher degree of reliability than just checking the document number. This checking is basic and required for absolutely all applications on the Internet.

Let’s start with the basic verification required by law – checking the reality of the name (身份证实名认证). It utilizes a basic API for checking the compliance of the full name and ID number. The user enters their real name and ID number in the form below.

Verification in the DiDi Chuxing app

On the server side (there are dozens of similar agents), a check takes place against the MPS databases and an answer is given – whether it matches or not. In practice, it looks like this:

By purchasing a package of services on any marketplace (for example, from Aliyun), we, as a developer, can transfer the data entered by the user to the server, which will answer us "0" or "1", showing whether the ID-card number matches the specified full name or not. We transfer the ID-card number and full name entered by the user and receive the answer "1" or "0".

Since the ID number contains the citizen's date of birth, it is very convenient at this stage to set up age restrictions or determine the age group for targeting.

There are two more types of verification:

The first one checks that the phone belongs to a specific person. Since all SIM cards in China are personal – i.e. bought and registered for someone, then such a check can help at least make sure that the phone number registered for a certain person is also in the hands of the user performing a certain action. It all happens the same way – the user needs to enter a phone number, ID-card and full name, and the service gives the answer 0 or 1 – showing whether the data matches. Obviously, it is logical to use this in conjunction with the API for sending verification SMS to the entered number.

The second is verification by bank card number. In fact, it is the same thing, but a bank card number is used instead of a phone number. Naturally, it must be issued by a bank in mainland China. After that, validation takes place according to the parameters "full name", "ID-card number", "bank card number", and if all three parameters match, the system gives the answer "1" – the validation is passed. It is logical to use it in the interface related to finance – if the user pays into the account from the same card through which s/he is verified, then there is a high probability that this is him/her.

All such APIs can be purchased from numerous intermediaries at market.aliyun.com, apistore.cn, juhe.cn and many others. In China, it is common practice not to contact end users directly, but only through authorized agents. That is, this is really a database of the MPS, People's Bank, three mobile operators, but it will not be possible to directly sign an agreement with them – only through agents.

All three of the above methods are good, but they have one major drawback – they do not guarantee that the application is currently being used by the person that enters their full name. The bank card number and mobile phone number of another person can be found out – just like the number of the ID-card. Moreover, it is far from certain that they were not stolen. And this is where the cutting-edge technology helps – face recognition.

Such verification exists in many applications, in this case it is "My Tax" app

How does this kind of verification function? Since every citizen of the PRC, when receiving an ID-card, submits facial biometrics, it can also be obtained through API from the MPS. You do exactly the same thing – give the user a form for entering the ID-card number and full name (or, as in the screenshot above, connect the OCR API). This is followed by face recognition and check of the image against the MPS databases. To prevent fraud by using photos (or verifying a sleeping/unconscious person), the API requires the user to say a few words (in Wechat, for example, the user needs to read the generated four numbers) and roll your face in front of the camera – just like when setting up Face ID in iPhones.

After the image capture procedure, the image is sent to the database and the server gives an answer, but not in the "1" or "0" format, but in the range from 0 to 100, showing the percentage of the scanned face coincidence with the original stored in the database. API providers recommend accepting verification with a parameter > 85%.

Approximate prices are shown in the screenshot below, a biometric verification API will cost you from 0.5 to 0.36 yuan per request (depending on the purchased quantity).

Well, there are a huge number of examples of practical implementation. Now the whole of China is rapidly switching to this sort of technologies, which are becoming omnipresent. Without any exaggeration.

At Beijing Capital Airport, gate counters are gradually being replaced with face scanners. By registering in the airline's application (so far only China Southern), you can board without a boarding pass and (in the near future) without documents – the gates are equipped with face scanners. You can go through border control (one of the few face recognition functions that works for foreigners as well). Passport to scanner, finger to scanner, face to camera – welcome to China. Finally, archaic checks in schools and kindergartens are a thing of the past – an acquaintance recently sent over a photo from the hall of her children’s school, where a recognition equipment at the entrance greeted her by showing the text “Vanya’s Mum”(伊凡妈妈). According to her, it recognizes her in a hat, and in glasses, and side on.

A detailed story about practical implementation can be found in my article on Habr