Document and Selfie Verification for Brazilian Users

Introduction

Document and selfie verification proves that the person signing up is the real holder of the identity they claim. The user photographs a Brazilian ID document, takes a selfie with a liveness check, and the system reads the document, confirms that a live person is in front of the camera and compares that face with the document photo. It is the layer on top of a CPF (Brazil's individual taxpayer ID) lookup: the lookup shows that the identity exists and matches, the selfie shows that it belongs to the person typing.

This guide covers the Brazilian documents you will see, what each check proves, where the flow fails in practice and how to integrate it.

When you need it

A CPF lookup with a name and date of birth match is enough for many flows, such as a marketplace buyer or a delivery customer. Document and selfie checks are worth their extra step when the cost of a stolen identity is high:

• account opening at fintechs and crypto exchanges,
• first withdrawals and payouts,
• credit and high-value transactions,
• onboarding of couriers, drivers and other service providers,
• age-restricted services where a registry check alone is not enough for your risk policy.

The usual pattern is to run the CPF lookup at signup for everyone and ask for the selfie only when the user reaches a risky action. Brazil KYC Requirements explains where regulation requires it.

The Brazilian documents you will see

Two practical consequences. First, your document reader has to cope with a lot of variation, especially in older RGs. Second, many users will try to submit the digital CNH from their phone instead of a physical card, so decide up front whether you accept it.

What each check proves

Document reading

The system reads the name, document number, CPF, date of birth and expiry date from the image. The CPF read from the document can then be compared with the CPF the user typed and with the registry data from a CPF lookup. A mismatch is a strong signal that the document or the account data is not genuine.

Liveness detection

Liveness detection checks that a live person is in front of the camera, not a printed photo, a screen replay or a mask. These spoofing attempts are called presentation attacks, and they are the reason a plain selfie upload is not enough. NIST runs public evaluations of presentation attack detection if you want to understand how the field measures it.

Face match

The face from the liveness check is compared with the photo on the document. A high similarity means the person in front of the camera is the person on the document. A low one means someone is using another person's document.

Together, the three checks answer one question: is this a real person, holding a real document, that belongs to them?

Where these flows fail in practice

• Glare and blur. Plastic cards reflect light. Clear capture guidance and on-screen feedback reduce retakes more than any model upgrade.
• Front and back. The CNH has information on both sides. Ask for both when you accept it.
• Desktop users. Many laptop cameras are poor for document capture. Hand the flow to the phone, usually with a QR code or a link.
• Borderline results. Not every case is a clear yes or no. Plan a manual review queue instead of forcing the system to approve or reject everything.
• Legitimate users who fail. Some real people will be rejected. Give them a way to try again and a path to human support.

Integrating it with CPFHub.io

CPFHub.io's Identity Verification runs document reading, liveness and face match on a page hosted by CPFHub.io, using the same API key as the CPF lookups. It accepts the CNH (including the digital CNH), the RG and the passport. The flow has three steps.

1. Create a verification link on your server

curl --max-time 10 -X POST https://api.cpfhub.io/kyc/links \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"externalId": "user-4821", "language": "en", "redirectUrl": "https://example.com/signup/done"}'

The response has an id and a url. Send the user to the url, or redirect them during signup. You can also pass a cpf you already know: if it differs from the document, the verification goes to review. Create one link per person, because anyone with the link can complete it.

2. Receive the decision by webhook

The kyc.decision webhook carries the link ID, your externalId and a status: approved, manual_review or rejected, with the reasons. It does not carry personal data. Verify the signature before trusting it:

import crypto from 'node:crypto'

export function isValidSignature(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  const age = Math.abs(Date.now() / 1000 - Number(parts.t))
  if (!parts.t || !parts.v1 || age > 300) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`)
    .digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(parts.v1)
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

Compute the HMAC over the raw body exactly as received, before parsing the JSON, with the secret stored in CPFHUB_WEBHOOK_SECRET. The header is x-cpfhub-signature. Reply with a 2xx quickly and process the event in a queue.

3. Approve only on a verified decision

The user returning to your redirectUrl proves nothing. Approve the account only after a webhook with a valid signature, or after checking the link with GET /kyc/links/{id}. Full details in the Identity Verification reference.

Data protection

Selfies and face matching involve biometric data, which is sensitive data under the LGPD (Brazil's data protection law). Article 11 lists the legal bases for sensitive data, including fraud prevention in identification and authentication processes. Explain the check in your privacy notice, define how long you keep the images, and confirm your legal basis with Brazilian counsel. The wider picture for companies outside Brazil is in LGPD for Foreign Companies.

Frequently asked questions

Which Brazilian documents can users submit?

The most common are the CNH (driver's license), the RG (state identity card), the new national identity card (CIN) and the passport. CPFHub.io's Identity Verification accepts the CNH, including the digital CNH, the RG and the passport.

Is a selfie required for KYC in Brazil?

Not in every flow. Regulated onboarding often combines the CPF lookup with document and selfie checks according to the risk policy. Lower-risk flows usually stop at the CPF lookup.

What does liveness detection protect against?

Presentation attacks: printed photos, screen replays and masks used to impersonate someone. Without liveness, a fraudster could pass a face match with a photo of the victim.

Does document and selfie verification replace the CPF lookup?

No, they answer different questions. The CPF lookup confirms that the identity exists and matches the data typed. Document and selfie checks confirm that the person typing is the real holder. High-risk flows use both.

Read also

• Brazil Identity Verification API: What Data You Can Get from a CPF
• Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
• KYC for Crypto Exchanges in Brazil: The Banco Central VASP Rules
• LGPD for Foreign Companies Processing Brazilian Personal Data

Conclusion

Document and selfie verification closes the gap a CPF lookup leaves open: it shows that the person signing up holds a real Brazilian document and is its owner. Use it where a stolen identity costs real money, plan for the variety of Brazilian documents and for manual review, and treat the biometric data with the care the LGPD requires.

Try Identity Verification and the CPF lookups with 50 free credits and no credit card at cpfhub.io.