Tax administrations have digitalized a large part of their interactions with taxpayers. In general, these no longer need to attend in person to complete a procedure. In this context, it is indispensable to authenticate the person behind the computer screen or mobile application, whether they are acting in their own name or representing third parties: a tax advisor, a friend, an employee of a company’s accounting department, or an external accountant. Regarding the challenges and best practices in this environment, you can consult the Digital Identity Guide for Tax Administration, which we discussed at the IDForo 2026 Summit.

However, there are other situations in which identifying individuals is important in “tax-related” areas, which becomes complicated when these interactions occur outside of administrative systems and involve third parties.

Let us imagine a fictional country, with its taxpayers, citizens, and residents—tax and otherwise—where the following situations occur:

• ▪︎ Withholding Mechanisms: These mechanisms have been implemented: taxpayers designated as withholding agents retain a percentage of the payment on their purchases, except when they purchase from other withholding agents. At the time of collection, the seller presents a copy of the resolution designating them as a withholding agent, which they have distributed among their points of sale. Although the copy is deteriorated, its QR code allows access from a phone to a tax administration website that confirms this condition. However, a malicious actor—let us call them Unspeakable Business LLC—could create a PDF that imitates an official resolution and a fake website, to which the QR code points, mimicking the appearance of the administration’s site, an attack known as Quishing.
• ▪︎ Age-Based Tax Benefits: The tax system grants a benefit to people over 65 years old —practically teenagers—, who pay a reduced VAT rate on their purchases. To access the benefit, you must present your national identity document or your permanent residence card at the time of payment. The seller verifies the age, photocopies the document, and applies the reduced fee. In addition, include the buyer’s identification number on the invoice to justify the lower tax This process can lend itself to abuse: a subject whom we will call Neighbor thug could obtain, by force or through deception, copies of the identity cards of the elderly people in the neighborhood and present them for his own purchases.
• ▪︎ Diplomatic reciprocity: In application of the principle of reciprocity, accredited diplomats receive a card from the Ministry of Foreign Affairs that they present when making their purchases so that the store does not charge the tax. The seller keeps a photocopy of the document as backup. This process can also be abused: after selling to a diplomat, Unspeakable Business LLC could reuse the copy of their credentials to justify VAT-exempt sales to other consumers, with or without the diplomat’s knowledge.
• ▪︎ Cross-Border Tax residence: A professional living in the country provides services to a company in another country. At the time of payment, they will ask you if you have a tax residence certificate that allows the double taxation agreement to be applied and the withholding tax not to be made. The professional enters the tax administration’s website, finds the option to request the certificate, and returns the next day to submit it. However, upon receiving a PDF in an unfamiliar format, the contractor, distrustful, requests an apostilled document.

All these processes could be significantly improved by the use of verifiable credentials: digital credentials whose authenticity, or whose attributes, can be securely verified. Depending on the mechanism used, this check can be performed without directly contacting the issuer, by simply knowing the digital signatures involved (for example, from the tax administrations of other jurisdictions).

The three key actors are the issuer, the organization that creates the credential; the holder, who stores it in a digital wallet and presents it; and the verifier, who checks its authenticity. Simplifying greatly, in a scheme like the one described here: The issuer signs the credential and links it to the cryptographic key of a wallet on the holder’s phone or computer. When presenting it, the wallet demonstrates that it controls the key and that the presentation corresponds to the data requested by the verifier. A fingerprint or facial recognition unlocks the wallet.

Wallets can use NFC (Near Field communication[1] for in-person presentations, something frequently used today when paying by bringing the phone close to the credit card payment terminal or read a QR code in a remote case (for example, on the tax administration’s web portal). It can also generate QR codes that allow checking the presentation. This last case is vital for third parties who only have an internet connection to validate the credential on the issuer’s site. When the  verifier uses a trusted channel, checks the URLs and, above all, validates the signature, the risk of Quishing drops drastically.  Furthermore, a credential can have dynamically updated parameters to identify, for example, when a certain quota or limit has been reached, or there can be single-use or limited-quantity credentials that allow for better modeling of each situation.

With these mechanisms, the previous scenarios could be simplified, be more efficient, and significantly reduce the risks of abuse:

• ▪︎ The registration credential issued by the tax administration would include, among its attributes, the status of a withholding agent. At the time of payment, the buyer requests the seller to present their withholding agent credential; the seller presents it from the wallet; the system checks the issuer, validity, and link to the device and applies or waives the withholding. The entire transaction, fully automatic, is completed in a few seconds. The information is recorded in the systems and will be reported to management when appropriate with verified data. No copy of a physical document is necessary.
• ▪︎ Diplomats would receive a verifiable credential issued by the Ministry of Foreign Affairs that allows businesses to verify their tax-exempt status at the point of sale. The diplomat brings his phone close to the payment terminal. The transaction is invoiced tax-free and the transaction recording and reporting are automated. Since there are no physical copies of documents and biometric authorization is required, Unspeakable business LLC would have a very difficult time using the credential to avoid paying the tax on another transaction or collecting the tax and keeping it for themselves.
• ▪︎ Citizens receive an electronic identity card that is stored in a digital wallet, either the official one or a compatible private one. At the time of purchase, the merchant or service provider must check at the point of sale if the holder meets the required age, without needing to share any other information available on the ID card, and if so, applies the reduced rate automatically through the system. The neighborhood thug, by appropriating the beneficiaries’ phones, would not have their face or fingerprint available to unlock those digital wallets, significantly reducing the risk of impersonation.
• ▪︎ The tax administration would issue the tax residence certificate as a verifiable credential, which the professional could present to the payer through the described protocol or at least by generating a secure temporary URL that would lead the foreign payer to the administration’s site that verifies the credential. The overseas payer must verify the address bar to ensure it corresponds to a secure connection and the official tax administration’s domain. Even so, they will have to follow the specific protocols demanded by their own legislation, but, if trusted lists are shared between jurisdictions, automation could be extended. To facilitate this use regionally, it would be enough for tax administrations, through enabling agreements, to share the information of their digital signatures (public keys) with their peers, so that each tax administration has certainty that the credential was issued (and signed) by its counterpart in another country.

It is clear that using verifiable credentials significantly reduces the risks of abuse and improves efficiency. However, its most complete, efficient, and secure operation requires the digitalization of many actors and a proper implementation across the ecosystem, to eliminate forgery, fraudulent reuse, and identity theft. Intermediate solutions, when for example the verifier does not have automatic systems, are still superior to current options in terms of efficiency, making abuse costly and complex. And although they improve the ecosystem, it is necessary to remember that some things will require regulatory adjustments: if a law explicitly asks for a photocopy of a physical document, well…

These scenarios assume that verifiable credentials form part of a nationwide digital initiative. This is not a distant possibility if we consider the digital driver’s license initiatives, currently in development or already implemented in several countries. Even without a national framework, a tax administration could independently improve its processes, reduce abuses, and decrease costs and risks for taxpayers by deploying verifiable credentials based on well-known standards for issuance and presentation protocols[2].

Verifiable credentials represent are a new paradigm, they invert the traditional model of digital identity. The issuer delivers the signed credential directly to its holder, who  stores it in their digital wallet and decides where, when, and to whom to present it. The user thus becomes the channel for information, and verification is done against the issuer’s signature, without needing to consult the issuer during every single transaction.

The holder retains complete control. They are the only one who knows all the presentations they have made, eliminating the need to maintain centralized databases with millions of credentials and usage logs, which are common targets for cyberattacks and surveillance risks.

Furthermore, selective disclosure allows the holder to present only the minimum necessary. For example, they can prove they are over 65 years old, without revealing their exact date of birth. In this way, privacy is protected by design.

What do you think? You are welcome to comment.

Best regards and good luck.

[1] Near Field Communication.

[2] W3C VCDM for the data model, and OpenID4VCI and OpenID4VP

54 total views, 18 views today