AFAIK not all NFC-enabled passports support Active Authentication. E.g least before US passports did not support it so cloning them is as easy as reading them via NFC.
So you cant fake non-existing passport because of issuer signature, but cloning is not a rocket science for many countries passports.
Re:One Million Passports Leaked Online
by Tangurena2 on Tuesday June 30, 2026 @08:55AM
(#48732080)
Nowadays, for US passports (I don't know about other countries), the number/key needed to let the chip talk to you is printed on the photo page, so the older way of reading the NFC from afar won't work without that number.
Yes for other countries, it’s a standards thing not something unique to the US!
This has nothing to do with ability to clone the passport. E.g anyone who held your passport for 10 seconds can still create clone with exactly the samw data on NFC chip.
Active Authentication is when NFC chip itself hold cross-signed signing key thar is not exportable so its possible to confirm passport wasnt cloned.
To second the photographed/photocopied requirements, as an expat, I am frequently asked to send a scan of my passport to people or entities that are not necessarily the most secure.
I also have a couple of important documents that are literally PDFs. My Canadian citizenship certificate is a PDF with a barcode in it, that I can print off a copy of if I need to mail it, or show on my phone to a consular office or a border guard if needed. My work visa here in New Zealand is a PDF with my passport number and a visa number, which my workplace and bank checked with an online database. Fundamentally, these and my passport are pointers to a row in various databases.