PhilSys Verification API for Businesses Explained

With a PhilSys verification API, a business can check a customer’s national ID details with the PhilSys registry from inside its own app, instead of inspecting the card by eye. Your backend sends the details read from a PhilID, ePhilID, or Digital National ID, and the API returns whether they match an official record. Because a valid record does not prove the person owns it, pair the API with liveness and face matching before approving anyone.

What a PhilSys Verification API Does

PhilSys, the Philippine Identification System, holds one identity record per registered person. So a verification API turns that registry into a check your systems can call automatically.

• It confirms existence. First, it tells you whether the identity details correspond to a real PhilSys record.
• It confirms consistency. Then it shows whether the name, birth date, and card number submitted agree with that record.
• It creates evidence. Finally, each call produces a timestamped result you can store for audits.

Typically, businesses use it wherever a customer presents a national ID remotely: account opening, loan applications, wallet upgrades, merchant onboarding, and hiring. Because BSP Memorandum M-2024-026 obliges the banks and e-money issuers it covers to honor every national ID format, those institutions in particular need a reliable way to check them at scale.

PhilID, ePhilID, Digital National ID, and PCN: What You Can Verify

The national ID comes in several forms, yet each carries the same underlying identity.

Credential	Form	Typical input for an API check
PhilID card	Physical card	Card details read by OCR, or QR data
ePhilID	Printed paper ID	Details read from the printout, or QR data
Digital National ID	Shown inside the eGovPH app	Details or QR data from the screen
PCN (PhilSys Card Number)	16-digit number printed on the card	Number plus name and birth date

Note the difference between the PCN and the PSN. By law, the permanent PSN stays confidential, so businesses should not ask customers for it. Instead, transactions use the card number. Our guide to PSN and PCN explains the distinction in full.

Government Check vs QR Check vs Manual Inspection

There are several ways to check a national ID. However, they differ in what they prove and how well they scale.

Method	What it proves	Scales to remote onboarding?	Proves the holder is present?
Manual inspection	The card looks genuine to a trained eye	No	Only in person
PhilSys Check (verify.philsys.gov.ph)	The QR signature on a PhilID card or ePhilID is valid	Limited; one scan at a time	No
National ID Check (everify.gov.ph/check)	The QR is valid on any of the three formats, app version included	Limited; one scan at a time	No
NIDAS / National ID eVerify	A live face matches the PhilSys record	Yes, for approved relying parties	Yes
Vendor PhilSys API plus biometrics	Details match PhilSys, and a live selfie matches the ID	Yes	Yes

In short, both QR tools confirm a credential is authentic. However, a stolen but genuine ID also passes them. So for remote onboarding, a check that ties the record to a live face is the one that actually stops impostors. For counter procedures, meanwhile, see how businesses run ePhilID checks.

API Flow: Request, Response, Match Result

Although each provider names fields differently, the flow is broadly the same. Here are the four stages.

1. Capture. First, the app photographs the ID, and OCR extracts the card number, name, and birth date.
2. Request. Next, your backend, never the mobile app, sends those fields to the verification API with your credentials.
3. Response. Then the API returns a result, typically a match or no-match per field, or a single combined status, plus a reference ID.
4. Decision. Finally, your rules decide: proceed to the selfie step, ask the user to correct a misread field, or route to review.

Result	Likely meaning	Suggested action
All fields match	Details agree with PhilSys	Continue to liveness and face match
Name mismatch only	OCR error, a married name, or a typo	Let the user confirm the name, then re-check once
Birth date mismatch	Misread digits or a borrowed ID	One retry, then manual review
No record	Invented details or wrong card number	Do not auto-approve; review or request another ID
Timeout or service error	Temporary outage	Retry with backoff, then queue

Verihubs ID Verification provides this record check for PhilSys, alongside LTO, SSS, and NBI sources, through one API. That way, customers without a national ID can still verify with another government record, which matters because PhilSys coverage is high but not universal.

Adding Face Match and Liveness

A matching record shows the identity is real and the details were entered correctly. It says nothing, however, about who is holding the phone. Therefore, a complete flow adds two biometric steps.

• Liveness first rules out printed photos, screen replays, and injected video, letting through only a human who is present right now.
• Face matching then compares that selfie with the portrait on the ID, or with a reference photo where your provider can access one.

So run liveness before the comparison. Otherwise, a fraudster with a stolen ID and a photo of its owner can pass both the record check and the face match. Our explainer on liveness detection covers the attack types in detail.

Consent and Data Privacy

RA 10173 treats government-issued identifiers as sensitive data, and the PhilSys Act adds its own limits. So handle it with more care than ordinary profile data.

• Get informed consent. First, explain that you will check the ID with official records and why.
• Collect the PCN, not the PSN. After all, the permanent number is meant to stay private.
• Store results, not more than needed. For example, keep the match result and reference ID, and limit how long you keep ID images.
• Restrict access. Also, only staff who handle reviews or audits should see raw ID data.
• Bind your vendors. Finally, your contract should cover security, retention, and processing location.

For a fuller treatment of controller duties, see our article on privacy rules for KYC.

Building a Fallback for Customers Without a PhilID

Not every customer holds a national ID yet. For example, some registered but are still waiting for a card, while others never registered at all. So an onboarding flow built only on PhilSys will turn away real customers.

• Offer other government IDs. A driver’s license, UMID, or passport can be validated with their own sources or read with OCR.
• Use the same biometric steps. Similarly, liveness and face matching work with any ID that carries a clear photo.
• Adjust limits by evidence. Start customers with lower limits when their ID cannot be validated against an official record, then raise limits as they add proof.
• Prompt for the PhilID later. Once a customer receives their national ID, invite them to add it and upgrade their account.

Above all, this approach keeps onboarding inclusive while still meeting due diligence duties. To see which alternatives customers commonly hold, check our roundup of accepted IDs.

Frequently Asked Questions

Is there an API to verify the Philippine national ID?

Yes. PSA offers authentication services to approved relying parties, and verification providers offer APIs that check national ID details against PhilSys records and pair them with face matching.

Can I verify a PCN online?

Yes. A PhilSys verification API takes the card number plus the holder’s name and birth date and confirms them against the registry. For an in-person check, scan the QR code with PSA’s tools instead.

How does PhilSys Check compare with a verification API?

PhilSys Check is a public web tool for scanning card and ePhilID QR codes, one at a time. By contrast, an API runs checks automatically inside your own systems and can be combined with liveness and face matching.

Why does PhilSys verification fail?

According to a December 2023 PSA advisory, PhilSys Check returns “Deactivated Card” when a PhilID or ePhilID is no longer active, and “QR Code could not be read” when the code is damaged, tampered with, or not from a PhilID or ePhilID. It also fails without an internet connection. PhilSys Check does not cover the Digital National ID in the eGovPH app, so use National ID Check for that format. For a deactivated or unreadable card, ask the holder to report it to PSA through hotline 1388 or info@philsys.gov.ph, and send the case to manual review instead of rejecting it outright.

Should businesses collect the PSN?

No. The permanent PSN is confidential by law. Businesses should use the PhilSys Card Number printed on the ID for transactions and verification.

Does a valid PhilSys record prove identity?

It proves the identity exists and the details match. However, to show that the applicant owns it, add liveness detection and face matching.

Check the Record, Then Check the Person

In short, a PhilSys verification API replaces slow manual inspection with an instant, auditable record check. Still, the record is only half of identity. So capture the ID with OCR, validate it through your backend, handle mismatches with clear rules, and finish with a liveness step plus face comparison. Customers onboard in minutes, and impostors with genuine stolen IDs stop at the last step.

Adding national ID checks to your onboarding? Request PhilSys API access from Verihubs and test it with your users.