Vending Machines That Scan ID: How ID Verification Works

A vending machine that scans ID reads an identity document, takes the date of birth, and releases the product only if the buyer is old enough. That sounds like one feature, but an ID verification vending machine actually runs three separate checks: reading the data, proving the document is genuine, and proving it belongs to the person at the machine. Most of the cost, and most of the failure cases, sit in the second and third. This page explains how each type of document is read, what authenticity and face checks add, and what the machine should do when a scan fails.

Quick answer

• Reading is easy. US and Canadian licences carry a PDF417 barcode with the date of birth as an unencrypted data element; passports carry a machine-readable zone (MRZ) under ICAO Doc 9303.
• Authenticating is harder. A forged licence can carry a perfectly readable barcode. Authenticity needs ultraviolet and infrared inspection, template checks or, on ePassports, verification of the chip’s digital signature.
• Matching the holder is a separate step. A face match compares the buyer with the document portrait; otherwise a person has to look.
• Mobile driver’s licences can send a signed “over 21” answer without a date of birth.
• Plan the failure path. When a scan fails or the verification service is unreachable, the machine should refuse the vend.
• An ID scanner does not make a venue lawful. In the US, vape vending still requires a venue nobody under 21 can enter.

What “scanning ID” can mean

Check	What the machine does	What it proves	What it does not prove
Barcode read	Reads the PDF417 barcode on a licence	The date of birth encoded on the card	That the card is genuine or belongs to the buyer
MRZ read	Images the passport or ID card and reads the MRZ lines	The printed data, with check digits catching misreads	That the document is genuine
Chip read with Passive Authentication	Opens an ePassport chip and verifies the issuing state’s signature	The chip data was issued by that state and is unaltered	That the chip is not a copy, or that the holder is the buyer
Document authentication	Images under visible, infrared and ultraviolet light; checks security features against templates	The document is likely genuine	That the holder is the buyer
Face match	Compares a live image with the document portrait, with a liveness check	The buyer is likely the document holder	Anything about the document itself
Mobile driver’s licence	Requests an age statement from the phone wallet	A signed answer from the issuer that the holder is over a given age	Varies with the wallet’s holder authentication

Most ID vending machines on the market do the first row and describe it as “ID verification”. That is worth knowing before comparing quotes.

US and Canadian driver’s licences: the PDF417 barcode

The AAMVA DL/ID Card Design Standard (2020) makes the PDF417 two-dimensional barcode “the minimum mandatory machine-readable technology” on compliant cards. The date of birth is a standard element (element ID DBB), so any reader that parses the AAMVA format can extract it.

Two lines in the standard matter for a vending design:

• “All mandatory and optional data must be unencrypted.” That is what makes reading easy. It also means a counterfeit card can carry a valid-looking barcode, so a barcode read alone proves only what the barcode says.
• US cards use a vertical layout for under-21 holders. That helps a person checking a card by eye. A machine reading the barcode does not need it, and the date of birth is the authority.

The standard also defines layered physical security features, including ultraviolet elements, that authentication readers look for. A reader that inspects those features costs more and takes longer than a barcode imager, but it is the difference between reading a card and checking one.

Passports and ID cards: the MRZ

ICAO Doc 9303 (eighth edition, 2021) defines machine-readable travel documents. On a passport (the TD3 format) the MRZ is two lines of 44 characters at the foot of the data page, holding document number, nationality, date of birth, sex and expiry, each protected by check digits.

Check digits catch reading errors, not forgeries. Anyone who can print a document can compute check digits. An MRZ read is therefore a fast, reliable way to capture the data from a genuine passport, and a weak defence against a fake one.

For a vending machine serving a tourist market, such as a hotel, an airport-side venue or a casino with international visitors, passport reading matters because the local licence is not the only document buyers carry.

The chip: ePassports and NFC

Most passports issued today contain a contactless chip. Doc 9303 Part 11 describes how a reader gets in and what it can prove:

• Access control. The reader opens the chip using keys derived from the MRZ (Basic Access Control) or the newer PACE protocol, so the page has to be read first.
• Passive Authentication. The chip data is signed by the issuing state. Verifying that signature against the state’s certificates proves the data is genuine and unaltered. ICAO is explicit about the limit: it “does not prevent exact copying of the contactless IC’s content or chip substitution”. Chip Authentication or Active Authentication addresses that, where the passport supports it.
• Portrait. The chip holds the holder’s facial image, a better source for a face match than a printed photo.

Chip verification needs the issuing states’ signing certificates kept current, which is one reason it is usually delivered through a verification service rather than built into each machine.

Mobile driver’s licences

Mobile driver’s licences built on ISO/IEC 18013-5 change the problem. Instead of reading a whole document, the machine asks a question and receives a signed answer. AAMVA’s mDL Implementation Guidelines require issuing authorities to include age_over_NN statements for the ages common in their jurisdiction: a 20-year-old’s licence would answer age_over_18 = True and age_over_21 = False.

For a vending machine that is close to ideal: the answer is signed by the issuer, and no name, address or date of birth needs to reach the machine. The limits are coverage and hardware. Not every jurisdiction issues mobile licences, and the machine needs a compatible reader (NFC or QR plus Bluetooth) and software that verifies the issuer’s signature.

Face match: is the document theirs?

A genuine licence belonging to an older friend is the most common way past a document check. The answer is a one-to-one face match: a camera captures the buyer, and software compares the face with the document portrait or the chip image.

Three things to specify:

• Liveness. Without a presentation-attack check, a photo or a phone screen held to the camera can pass. ISO/IEC 30107-3:2023 sets out how presentation attack detection is tested and reported. Ask any vendor what testing their liveness claim rests on.
• Accuracy is the vendor’s claim, not ours. NIST’s Face Recognition Technology Evaluation (FRTE) 1:1 publishes comparative results across algorithms. Ask your verification provider where their algorithm stands and under what image conditions.
• Privacy. A face template is biometric data. Under the GDPR, “biometric data for the purpose of uniquely identifying a natural person” is a special category whose processing is prohibited unless an exception applies. Some US states regulate biometric data specifically. Settle the legal basis before you specify the camera.

Facial age estimation, which guesses age from a face without any document, is a different technology with different evidence and rules. It is covered in its own article in this cluster.

When the scan fails

Failure handling is where ID vending machines most often disappoint, because it is rarely specified. Decide each row before the build:

Failure	Recommended machine behaviour	Specify
Document unreadable (glare, damage, wrong side)	Refuse; show how to present the document again	Number of retries before a cool-down
Document expired	Refuse; say it is expired	Whether any grace period applies; your regulator decides
Under age	Refuse; neutral message	What is logged; no image retained unless the rule requires it
Authenticity check fails	Refuse; neutral message, no accusation	Whether staff are alerted
Face match fails or liveness fails	Refuse; offer staff-release route if one exists	Retry limit
Verification service unreachable	Refuse; never fall back to dispensing	Whether staff release is available as the alternative
Repeated failures in a short period	Lock the age-restricted selections for a period	Lock duration; alert recipients

The service-unreachable row is the one that matters most. On our machines it resolves the safe way by default: the machine needs its connection to dispense at all, so an outage refuses the vend rather than releasing a restricted item on a check nobody made.

The legal context for ID scanning

This is a summary for planning, not legal advice. Rules change; confirm with the regulator where the machine will stand. Facts below are as of October 2026.

• US federal tobacco rule. Retailers must verify by photographic ID that a buyer of tobacco products, including e-cigarettes, is 21 or older; no check is required for anyone over 29 (21 CFR 1140.14). A machine cannot judge whether someone looks over 29, so a machine-based check in practice means checking everyone. Vape vending is allowed only in facilities that nobody under 21 can enter, so the scanner is an extra layer, not a substitute for the venue rule.
• Scanning and retention limits. Some states restrict what a business may do with licence data it scans. California Civil Code 1798.90.1, for example, allows a business to scan a licence to verify age or authenticity, but forbids retaining or using the data for any other purpose except as the section provides; a violation is a misdemeanour.
• UK. From 29 October 2026, vending machines that dispense vapes, nicotine products or tobacco to customers are an offence, whatever check they use.

What the machine should store

Store the minimum the rule requires. In most cases that is the result of the check (pass or fail and the reason), the time, the machine and the transaction ID, not an image of the document. A pass/fail record is easier to defend, cheaper to secure and less to lose. Our public-health machines already work this way: the machine sees a token or an access code, not an identity. Retention periods and deletion should be written into the specification, and your privacy regime, not the machine, sets them.

What to specify if you are buying one

1. The check your regulator accepts, and which layers it needs: read only, authenticate, face match, or a staff check. The trade-offs between ID scanning and the other approaches are on the age-verified vending hub.
2. The documents to accept: local licences, passports, national ID cards, mobile licences.
3. The verification service, if one is required, and its API documentation.
4. The failure behaviour for every row in the table above.
5. What is logged, for how long, and who can read it.
6. The cabinet. A document reader and camera have to be designed in. A shallow wall-mounted vape cabinet has less room than a floor-standing one.
7. Payment, specified alongside the reader so the two do not compete for space. See payments.

Our kiosk platform is Android-based and open, and barcode scanners, RFID readers and passport scanners are already integrated on kiosks we build for transport operators. For age checks we integrate the reader and the verification service you nominate. Hardware and software are designed in-house, so the check, the interface and the record are ours to change. We build to the compliance requirement you state; we do not certify that a machine meets any age-restriction law, and we do not publish an accuracy figure for someone else’s verification service. For budget, see vending machine cost; an ID reader and service integration are quoted on top of the published machine prices.

Where an ID scanner is the wrong answer

• Where vending of the product is not allowed. No scanner fixes a prohibition.
• Where staff already check ID at the door of an adult-only venue. A staff-release or pre-verified membership model may satisfy the rule with less cost and less personal data at the machine.
• Where privacy law makes a face match or document capture hard to justify. An off-machine check that sends the machine only a yes or no may be the better design.
• Where connectivity is poor and verification is remote. The machine will refuse often; fix the signal or change the check.
• At very low volume. A verification integration is project work; for a handful of sales a week, a staffed counter is cheaper.

Frequently asked questions

How does a vending machine scan an ID?

A reader at the machine captures data from the document. On US and Canadian driver’s licences that is usually the PDF417 two-dimensional barcode on the back, which holds the date of birth as a standard data element. On passports and many ID cards it is the machine-readable zone, the lines of characters at the bottom of the data page, and on ePassports it can also be the contactless chip. The machine compares the date of birth with the legal age and releases the product only if the check passes. Stronger systems also check that the document is genuine and that it belongs to the buyer.

Can a fake ID fool a vending machine ID scanner?

A scanner that only reads the barcode can be fooled. The AAMVA card design standard requires the mandatory and optional barcode data on US and Canadian licences to be unencrypted, so a forged card can carry a barcode that parses perfectly. Defences are layered: an authentication reader that inspects ultraviolet and infrared security features, a verification service that checks the document against known templates, a face match against the portrait, or a staff check. Each layer adds cost and time, and none is perfect.

Does an ID scanner make vape or tobacco vending legal?

Not by itself in the US. The federal rule allows e-cigarettes to be sold from vending machines only in facilities where the retailer ensures that no person under 21 is present or permitted to enter at any time. That condition is about the venue, so a scanner on the machine does not make a mixed-age venue lawful. In the UK, consumer vending machines for vapes, nicotine products and tobacco become an offence from 29 October 2026 regardless of the check. An ID scanner is a second layer where vending is already permitted.

Can a vending machine read a passport?

Yes. Passports follow ICAO Doc 9303, which puts the holder’s details, including date of birth, in a machine-readable zone of two lines of 44 characters with check digits. A passport reader images the page and reads the zone. On an ePassport the reader can also open the contactless chip using data from the zone and verify the issuing state’s digital signature over the chip data, known as Passive Authentication. That proves the chip data is genuine and unaltered, though ICAO notes it does not by itself prevent chip copying or substitution.

What is face matching on an ID vending machine?

Face matching compares a live image of the buyer with the portrait on the document or chip to check that the document belongs to the person using it, a one-to-one verification. A liveness or presentation-attack check guards against holding up a photo or a screen; ISO/IEC 30107-3 defines how such defences are tested. Face matching processes biometric data, which the GDPR treats as a special category when used to identify a person, and some US states regulate it specifically, so confirm the privacy rules before you specify it.

What happens if the ID scan fails?

The machine should refuse the vend and tell the buyer why in plain language: document not readable, expired, under age, not verified, or service unavailable. What it must never do is fall back to dispensing because a check could not be completed. Operators also decide whether to allow a limited number of retries, whether to offer a staff-release alternative, and what is logged, normally the result and time rather than an image of the document. These are specification decisions made before the build.

Can a vending machine check age with a mobile driver’s licence?

It can be built to, where the jurisdiction issues them and the reader supports the standard. Mobile driver’s licences built on ISO/IEC 18013-5 can release a signed age_over_NN statement such as age_over_21 without revealing the date of birth or name. AAMVA’s implementation guidelines require issuing authorities to include the age_over_NN statements common in their jurisdiction. For a vending machine that is attractive: a cryptographically signed yes or no, and much less personal data held at the machine.

Can KioskForce build a vending machine with an ID scanner?

Yes. Our kiosk platform is Android-based and open, and we already integrate peripherals of this class, including barcode scanners, RFID readers and passport scanners, on kiosks built for transport operators. For age checks we integrate the reader and the verification service you nominate; the accuracy claim belongs to that service, so we do not publish one. We build to the compliance requirement you state and do not certify that a machine meets any age-restriction law.

References

• AAMVA — “DL/ID Card Design Standard (2020)”, Annex D, Mandatory PDF417 Bar Code (accessed 2 October 2026). https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf
• ICAO — “Doc 9303: Machine Readable Travel Documents”, eighth edition 2021, Parts 4 and 11 (accessed 2 October 2026). https://www.icao.int/publications/doc-series/doc-9303
• AAMVA — “Mobile Driver’s License (mDL) Implementation Guidelines”, version 1.3 (accessed 2 October 2026). https://www.aamva.org/getmedia/261ed16b-3f5c-4678-a2db-cc3016934234/MobileDLImplementationGuidelines-Version1-3.pdf
• eCFR — “21 CFR Part 1140: Cigarettes, Smokeless Tobacco, and Covered Tobacco Products” (section 1140.14; as amended 89 FR 70486, 30 August 2024; accessed 2 October 2026). https://www.ecfr.gov/current/title-21/chapter-I/subchapter-K/part-1140
• California Legislative Information — “Civil Code section 1798.90.1” (accessed 2 October 2026). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.90.1
• ISO — “ISO/IEC 30107-3:2023 Information technology — Biometric presentation attack detection — Part 3: Testing and reporting” (accessed 2 October 2026). https://www.iso.org/standard/79520.html
• NIST — “Face Recognition Technology Evaluation (FRTE) 1:1 Verification” (accessed 2 October 2026). https://pages.nist.gov/frvt/html/frvt11.html
• GOV.UK — “Tobacco and vaping product vending machine ban” (published 11 August 2026). https://www.gov.uk/guidance/tobacco-and-vaping-product-vending-machine-ban

Related

• Age-verified vending machines: the hub for this cluster
• Biometric and facial age estimation on vending machines
• ID scanning and privacy: what an age-verified vending machine should store
• Wall-mounted vape vending machines
• Are vape vending machines legal?
• Which age-restricted products can you sell from a vending machine?
• SMS2Vend with external validation API

Talk to us about an ID-scanning vending machine

Send the product, the jurisdiction, the documents you need to accept and the check your regulator requires, plus any verification service you already use. We will tell you which reader and failure behaviour fit, and what it adds to the machine.