Malaysia's new MyKad puts a biometric QR on 24 million IDs
Malaysia launched a new MyKad with 53 security features and enforcement-only biometric QR verification, joining the global wave of chip-anchored national IDs.
Malaysia's national identity card just entered its verification-first era. Applications opened this month for the new-generation MyKad, destined for roughly 24 million Malaysians, carrying 53 progressive security features and a QR code that enables biometric verification, with live facial matching against National Registration Department records.
The most interesting design choice is restraint. Against supplier suggestions that the card combines both functions of QR verification and facial matching for broad use, the National Registration Department clarified that the QR is restricted to authorized enforcement use, unreadable by ordinary smartphone cameras, and reserved for authenticity confirmation by certified officials with certified equipment. No payments, no public scanning, and the once-bundled Touch 'n Go transit function is gone entirely, moved to separate cards and wallets.
That restraint is a policy statement: the ID card is becoming a verification anchor, not a super-app, and Malaysia is drawing the line between the two more explicitly than most national programs have managed.
What the new MyKad actually does
The card's verification model runs through controlled channels. A certified officer scans the restricted QR with certified equipment, confirming the card's authenticity against issuance records, and live facial matching binds the holder to the National Registration Department's biometric file. The 53 security features harden the physical artifact against forgery; the QR-plus-biometric path hardens the verification event against borrowed and counterfeit cards alike.
The rollout also runs beside, not inside, Malaysia's digital identity track: MyDigital ID continues its own upgrades, including facial-verification kiosks, while the physical card modernizes separately. For a population of card-carriers, that parallel-track approach keeps the physical credential authoritative while the digital layer matures, the sequencing most national schemes have converged on.
The global pattern: national IDs become cryptographic anchors
MyKad's redesign joins a queue. Italy retired paper identity documents for the biometric CIE in August. NFC passport chip verification reached industry-standard status this year. The EU's wallets arrive atop national eID roots, the US blessed mobile driver's licenses for bank identification, and biometric national ID programs across Asia and Africa keep hardening the physical credential even as digital counterparts launch.
The through-line: states are converting identity documents from visual artifacts into cryptographic ones, verifiable by machine against authoritative records rather than by eye against experience. Every such upgrade quietly retires a class of document fraud, and shifts the residual risk to the same two places it always goes, the borrowed genuine credential and the manipulated verification session.
What it means for businesses verifying Malaysians
For banks, fintechs, and platforms serving Malaysia's market, the new card raises the ceiling on document assurance: a chip-era, feature-dense credential validated through proper channels beats any photograph-and-inspect flow. The residual work is the familiar pair. Presenter binding: liveness and face matching that confirm the person holding the card is its subject, since a genuine card in the wrong hands still passes authenticity checks. And session integrity: capture-path verification so the card being validated was not injected media in the first place.
That is the division of labor across the deepidv platform: credential validation to the strongest available channel, deepeye's structural liveness binding the presenter, and telemetry forensics keeping the session honest. National programs are doing their half of the work; verification stacks owe the other half.
Malaysia MyKad FAQ
- What is new about Malaysia's MyKad?
- The new-generation MyKad, with applications open since September 2026, carries 53 progressive security features and a QR code enabling biometric verification, with live facial matching against National Registration Department records. It is expected to reach roughly 24 million Malaysians.
- Can anyone scan the new MyKad QR code?
- No. The National Registration Department restricts the QR to authorized enforcement use with certified equipment; ordinary smartphone cameras cannot read it. It confirms card authenticity for certified officials and does not support payments or public verification.
- Does the new MyKad replace MyDigital ID?
- No. The physical card and Malaysia's digital identity program run on parallel tracks: MyKad modernizes the physical credential while MyDigital ID continues separate upgrades, including facial-verification kiosks. The card remains the authoritative credential while the digital layer matures.
- Why did Malaysia remove Touch 'n Go from MyKad?
- The new design separates identity from payments: transit and wallet functions moved to dedicated cards and the Touch 'n Go eWallet. The removal reflects a broader policy pattern of keeping the national ID a verification anchor rather than a multi-function super-app.
- How should businesses verify the new MyKad remotely?
- Through layered checks: validate the credential to the strongest channel available, bind the presenter with liveness and facial matching so a genuine card cannot be used by the wrong person, and verify the capture session itself so injected media never impersonates a card read.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds, catch deepfakes that liveness checks miss, and let honest users through while keeping bad actors out.
Learn More