Smartphone app can unmask forged documents

Researchers at ETH Zurich have developed a smartphone app that can be used to check the authenticity of documents and other items. Extracts from the debt enforcement register of the City of Zurich are being made forgery-proof as part of a pilot project.

Expensive watches, bank statements, degree certificates and official documents: there are many things that can be forged and even more reasons for forging them. Researchers from the Information Security group under David Basin have developed a smartphone app to put a spoke in the wheel of forgers.

While the principle is simple, the technology behind it is complex. The organization that issues a document provides it with a QR code, saves the original in encrypted form on a server and sends a printed copy to the recipient. Anyone wishing to check the authenticity of the printed document then opens the organization's verification app, scans the QR code and films the document until the app gives the green light.

This normally lasts little more than a second. The app compares the individual images of the film sequence with the original and flags any changes, even the smallest, in real time on the screen. For reasons of data protection, the filmed document is not stored on the smartphone.

The challenge for the researchers lay in ensuring that only relevant differences were displayed and not things such as coffee stains, creases or worn bits of paper. The app also works if someone directly films a scanned version of the document on a computer screen.

Digital authentication for the real world

Despite all promises in the past, technological progress has not resulted in the paperless office. "The digital and physical worlds complement each other," says Martín Ochoa, lead author of the underlying research article published in the Annual Computer Security Applications Conference.

"Today the authentication of digital documents is very highly developed. It therefore made perfect sense to us to extend the principles of digital authentication to the physical world."

In order to leverage the technology, he founded ETH spin-off thenti together with David Basin.

"Paper is the link between the digital and the real world," adds Basin. "There are more and more QR codes and augmented reality applications that are merging the two areas with each other." It is therefore important to develop authentication technologies that do justice to both areas.

The need is there at any rate. According to reports in the media, a so-called "degree mill" sold more than 200,000 forged pseudo-academic certificates for around USD 50 million in 2015 alone.

Pilot project in Zurich aims to protect extracts from the debt enforcement register

The City of Zurich is also aware of this problem. Anyone in Switzerland wishing, for example, to rent an apartment or lease a car will generally be asked for an extract from the debt enforcement register. This provides information about whether debt enforcement proceedings have been initiated against such person in the past five years.

As those with an entry must expect significant disadvantages, document forgery is a common occurrence. The debt enforcement offices of the City of Zurich alone therefore receive several enquiries each day as to whether information submitted is forged, which is estimated to be the case once or twice per week. The number of unrecorded cases is likely to be considerably higher.

This is not only annoying for landlords but also causes unnecessary outlay for debt enforcement offices as well as high costs and expenses for prosecution authorities and courts.

"When we heard about the technology, we knew immediately that this was something of potential interest for us," says Alejandra Itel, Organizational and IT Project Manager at Zurich City Council: "On the one hand, because it could solve an expensive problem for us, and, on the other, because it would enable us to contribute to strengthening trust and security."

The debt enforcement offices immediately registered their interest and will be deploying the solution from March 2024. If the pilot proves successful, other areas of application in the city could follow. Further debt enforcement offices throughout Switzerland can soon be expected to deploy the new technology.

Three-dimensional objects can also be checked

The City of Zurich is implementing the pilot project and using its experience to support the final development of the solution. The thenti business model envisages free use of the app for a given number of checks, after which a subscription must be taken out.

"We naturally hope that the example of the City of Zurich attracts further interested parties," says Martín Ochoa. The team is simultaneously working on further potential applications. For instance, the app is soon not only to be able to identify differences with two-dimensional documents but also with three-dimensional objects.

This could, for example, enable manufacturers of luxury watches to register their products in the system so that customers are able to compare their watch with the registered specimens and thus eliminate any forgery. "Even top precision and quality products display small idiosyncracies that our system is able to recognize," promises David Basin.