WebView Biometrics: the four questions behind a verification

Each question rests on the one before it. The first three always run; the fourth is an additional validation, available in some countries, that you add when the process warrants it.

WebView Biometrics runs that sequence inside the WhatsApp conversation, it is in production today in banking onboarding, and several of its steps have just been updated.

Initial load time dropped from around 8.9 seconds to around 2.6, roughly 3.5 times faster.

That stretch was the most expensive one. Whoever abandons there failed no check and was rejected by nothing: they never got to try. Most of them would have finished, and they were lost staring at a blank screen before taking the first photo.

The difference shows up most where the connection is worst, which is exactly where it was needed. On networks below 4G the first screen appears within those 2.6 seconds, and on 3G a skeleton of the interface renders while the rest loads, instead of leaving the screen empty.

A selfie with half-closed eyes, or a glare sitting across the document's expiry date, is not enough to support what comes next.

The WebView now checks this while the person is taking the photo: it validates in real time that the eyes are open and the face fully visible, and it says so on the spot. Before, the problem surfaced at the end, when nothing could be corrected. It also detects more than one person on camera, because a session belongs to a single user.

Capture quality thresholds are now configured per company. An institution serving people with worn documents and one verifying corporate accounts do not need the same level of strictness.

The review has two levels. The Standard level identifies the document's type and origin, checks that it is still valid, and validates its physical security elements — holograms, background patterns, protection zones. It reads the MRZ or the barcode when the document has one, and verifies that the data matches across zones. The Advanced level adds a forensic analysis of the document as a whole: visual coherence, consistency across zones, and manipulation or recapture patterns. It can reject on its own, and it is meant for high-risk flows or regulated sectors.

Type, origin and validity stay active at every level. When the expiry date is illegible because of resolution or glare, the case goes to human review instead of being rejected outright.

The document reader covers national IDs and passports across Latin America.

Facematch measures how closely the selfie resembles the face extracted from the document. The threshold is picked between Low (65%), Standard (80%) and Strict (90%), accepts values in between, and defaults to 70%. Raising it lowers impersonation risk and raises the rejection of legitimate people.

With these three questions settled, most processes have what they need.

Some processes justify one more question. Opening an account, authorizing a disbursement or enabling a movement of money are cases where it is worth checking against the state source before treating the result as final.

In Ecuador the validation cross-checks Registro Civil automatically. In Peru the result arrives integrated into the session data, so the flow reads it without a separate call. In both countries the source returns the official photograph, which makes it possible to compare the selfie against the government record as well as the portrait printed on the document. Colombia cross-checks data. When the case warrants it, the verification goes to human review.

Metrics v2 brings the biometric verification journey: the whole path, from the moment the WebView opens until the verification ends.

Every stage — session start, terms acceptance, selfie instructions, document instructions, liveness capture, front and back of the document — reports how many sessions reached it, how many stopped there, and how long people spent on it. Retries are counted separately, at each point where someone can try again.

Crossing those three numbers is what turns data into a decision. A stage with a high drop and a short dwell usually means the person did not understand what was being asked. One with a long dwell and many retries points at the capture itself: lighting, framing, camera. And because every event carries device metadata, a pattern that looks general can turn out to belong to one model or one browser.

The improvements arrived on their own; the decisions are still yours: whether you add the official-source check, and how strict the facematch threshold and the document verification level are. Those last two are global for your company, so an adjustment made with one use case in mind applies to every flow using WebView Biometrics.