# Digital ID Wallets: What Actually Happens When You Add Your Driving Licence to Your Phone
You tap your phone against a terminal at airport security. No barcode on the screen. No plastic card handed over. The reader beeps, the officer looks at a screen, and you walk on. That tap is the whole point of a digital ID wallet, and it works very differently from the photos-of-your-ID apps most people already use.
Here is what actually happens, what leaves your phone, and where the design genuinely limits what a bouncer or a barista can see.
## The standard behind it: ISO 18013-5
The tap is not a file transfer. It is a protocol called ISO 18013-5, and it defines how a phone presents a mobile driving licence, or mDL, to a verifier. When we read the standard’s overview pages before writing this piece, the parts that surprised us were how little data has to move and how much control stays on the phone.
Your licence data gets stored on the phone in a signed chunk. The issuing authority, your state DMV or national road agency, cryptographically signs that data. When you tap, the phone doesn’t upload the licence. It sends only the fields the verifier requests, and it shows you a screen first saying exactly which fields are about to be shared. We read the documentation on three current wallet apps while writing this, and we found the same field-by-field request flow in all three.
That confirmation screen is part of the standard, and it is the single biggest difference from handing over plastic. A bar scanner can request age verification only, and a properly configured exchange shrinks what leaves the phone from 20-plus printed licence fields to 2. If the app is built properly, the bartender’s screen shows a checkmark and a birthdate, and nothing else. Not your address. Not your full licence number. Not your photo.
## What the phone actually sends over Bluetooth
The physical tap uses NFC on most current phones, with a Bluetooth fallback for longer-range reads. Apple’s Wallet and Google Wallet both support the mDL format, and airport security is the flagship use case. TSA reader lanes in participating US airports accept them today. According to Apple, every iPhone since 2014 carries the NFC hardware this needs, and mainstream Android phones have had it for about 5 years.
During a session, the reader and the phone run a challenge-response exchange. The reader proves what it is, the phone proves the licence is genuine and unmodified, and the fields flow across in an encrypted channel. Session logs can be recorded on both sides, which raises a privacy question worth asking before you enrol: some implementations let the verifier keep a record that you presented your ID, even when the data shown was only your age.
There is no central database of taps. But there is also no rule stopping an individual verifier from logging who walked in. If that concerns you, keep the plastic card in your wallet for venues you do not trust.
## Why this beats the photo-of-your-licence approach
Most people already carry their licence as a photo in their camera roll or a scan in a note-taking app. That approach hands over everything at once. The person holding your phone sees your full name, address, date of birth, organ donor status, and often your home address in the background of the photo.
The wallet approach inverts that. Data is requested field by field, and the phone shows what will be shared before the session runs and logs what left after. A verifier asking “is this person over 21?” receives a yes or no plus a birthdate, and nothing about your licence class or restrictions. The phone also refuses requests that exceed what the verifier is entitled to ask for, depending on how the state configured the relying-party registration.
The practical weak point is the enrolment step. Some states verify you by taking a selfie against your stored DMV photo. Others require you to scan the barcode on your physical card. Once enrolled, the licence lives on the phone, encrypted, and works offline. Airplane mode does not kill it, because the presentation protocol runs locally over NFC.
## The risks worth stating plainly
Loss and theft work differently. If your plastic licence is stolen, someone has your ID number. If your phone is stolen, the wallet stays locked behind your biometrics or passcode, and you can freeze the credential remotely through the issuing app. Report it the same way you report a card to your bank, fast.
Faked readers are the sharper concern. A rogue terminal could pretend to be a legitimate verifier and harvest whatever fields your state lets through. Apple and Google restrict which reader apps can request mDL sessions, and states register relying parties, but a fake terminal in the wild remains the hardest attack to rule out. The confirmation screen is your last defence. Read it. If a petrol station pump is asking for your full address, cancel the session.
Also worth knowing: the wallet does not replace your physical licence everywhere yet. Traffic stops, bank branches, and most government offices still want the card. In the UAE, where digital ID via UAE Pass is already standard for government services, the phone has largely replaced the paper card for admin tasks. Elsewhere the coverage is patchy and you will find out at the counter.
## Setting it up, step by step
Open Wallet, tap the plus button, and choose your state’s driving licence or ID option. You will need your physical card, because the barcode scan is the common verification route. Approve the biometric prompt, and the licence lands in the wallet alongside your payment cards.
Before your first real use, test it somewhere low-stakes. Add it before a flight, not during one. The TSA lane is the most reliable first use, since participating airports have readers that accept the mDL format and staff who have seen it before.
If you carry your phone in a case with cards, keep the physical licence in a different pocket anyway. Batteries die, screens crack, and a traffic officer in most countries does not yet have a reader for your phone.
## The short version
Digital ID wallets are a real improvement over photographed documents because they share the minimum, show you what is leaving, and survive offline. The parts that deserve your attention are who logs your presentation and which fields your state allows verifiers to request beyond simple age checks. Everything else is plumbing, and the plumbing works.
If you also worry about what your phone leaks in other directions, our pieces on [SIM swap fraud](https://opticflux.com/sim-swap-fraud-how-attackers-take-over-your-phone-number-and-every-account-tied-to-it/) and [passkeys after phone loss](https://opticflux.com/passkeys-what-actually-happens-when-you-lose-the-phone-they-live-on/) cover the account side. The [encrypted DNS explainer](https://opticflux.com/encrypted-dns-explained-what-your-isp-sees-and-what-doh-actually-hides/) covers what your network provider still sees.