Case Study · Marketplace × Identity
How MiAuto.ec shuts out fake listings by verifying both sides
Listing a car, or getting a seller’s number, costs something a fraudster cannot pay: proven identity.
This is how MiAuto.ec and ID Protekt fit together.
The problem: fake listings and anonymous sellers
A vehicle marketplace lives or dies on trust.
A vehicle marketplace lives or dies on trust. If listing is free and anonymous, the marginal cost of a fake advert is also zero, and the market fills with them faster than human moderation can empty it. In Ecuador that isn't hypothetical: a single ring defrauded around eighty people with fake luxury-car sales before eleven of its members were arrested in Guayaquil and Quito.
And the problem cuts both ways. A seller’s phone number printed on a public page can be harvested by anyone, and an anonymous buyer is as hard to hold to account as an anonymous seller.
The industry's usual answer is to ask for a photo of an ID. We happened to have a team building chip-based identity verification at the same time — and the evidence that a photo no longer proves anything, because 14.8 million Ecuadorian identity records, more than 10 million high-resolution ID images and even fingerprints surfaced on dark forums in May 2026.
So we didn't buy a vendor. We used our own, and forced ourselves to live with the result.
The solution: verified identity on both sides
The whole architecture rests on one rule: no proven identity, no listing and no contact. A seller verifies before an ad reaches review, long before a charge exists; a buyer verifies before getting any seller’s number.
The order matters for a very concrete reason, and it isn't philosophical. When someone pays for an ad, an SRI-authorized electronic invoice is issued. An authorized invoice cannot be deleted: if the listing later had to be rejected for fraud, removing it isn't enough — it needs a refund and a formal cancellation, which is a legal process rather than a button.
That is why each gate lives at one point in the backend and not in the interface. A rule spread across screens breaks the first time somebody adds a new screen; a rule that lives at one point on the server only breaks if somebody deletes it deliberately.
The buyer’s side follows the same rule. Browsing stays open to everyone, but a seller’s phone number appears on no web page and in no public API answer. To reach a seller on WhatsApp or by phone, a signed-in person verifies once with ID Protekt — with no form to fill in, because the chip says who they are — and then receives the number, for at most 30 sellers a day. Each request is recorded against the ad, and the seller sees how many verified people contacted them. Harvesting numbers in bulk is pointless.
Verification, step by step
The same steps for a seller and for a buyer, on their own phone, without sending a photo of anything.
Open ID Protekt
MiAuto hands the person — seller or buyer — to the ID Protekt app, on iOS or Android, and gets them back when it's done. It's native code, not a web page, because it needs the NFC radio and the camera.
Hold the ID to the phone
Read the printed code, then rest the document against the back of the handset. The chip opens with keys derived from the document itself.
The state's signature is checked
Passive Authentication against the issuing state's trust anchor, on the phone. If the document was altered, verification fails and nothing goes through.
Liveness and a 1:1 match
A live selfie is compared against the portrait the state put in the chip. The comparison happens on the phone.
Nothing is uploaded
The portrait and the selfie produce a verdict and are discarded. MiAuto never receives anyone's face — only whether it matched.
What remains is an identity, not a file
MiAuto receives the verdict and the name and number the chip proved — never a document image or a face. A buyer types nothing, and a seller’s invoice details come from the same proof.
Both sides, one rule
What changes when the buyer is verified too.
The number is never public
No web page and no public API answer carries a seller’s phone. A signed-in, verified person gets it — at most 30 sellers a day — and every request is recorded against the ad.
One person, one account
The document is kept for this only as a one-way hash: enough to refuse a second account with the same document once the chip proves who holds it. The same hash keeps the free first ad to one per person.
Foreign documents, same chain
ICAO passports and chip ID cards of other states go through the same Passive Authentication, so Ecuadorians abroad and foreigners living in Ecuador verify the same way.
It fails closed
No verification, no listing and no contact. A chip that doesn’t verify never becomes a lower-confidence pass.
Anyone can report
Anyone can report an ad from the site or the apps. Moderators see every report, with those from verified people marked, and can take an ad down.
A refund ends the ad
A refunded payment takes its ad down automatically: money that went back never keeps a listing alive.
What the implementation taught us
What the design got right:
- On-device biometrics isn't only privacy, it's cost. With no server GPU, verifying one more seller costs essentially nothing — which is what makes a free first ad possible
- Failing closed is sellable. A seller whose verification fails is not lost revenue: they are precisely the one we didn't want
- Nobody retypes what the chip proved. A seller’s invoice details come from the verified identity and the sign-in email, and a RUC has to belong to the verified cédula, so a borrowed number stops there
- Two separate consents — sharing facts, and processing a face — was legally right and turned out to be the better experience: people understand what they are agreeing to
What forced us to change:
- NFC isn't where you think it is. The antenna moves between handset models, so “hold the document to the phone” had to become an animation rather than a sentence
- A missing portrait is a failed verification, not a finished one. A chip with no readable portrait cannot produce a 1:1 match, and letting it through would have been worse than not verifying at all
- One verified person had to mean one account. A verification that can be repeated on a second account only proves that someone exists. Refusing the duplicate took nothing more than a one-way hash of the document
- We verify people, not cars. Saying that out loud on the page, rather than letting a buyer assume otherwise, was a product decision as much as an honesty one
The journey, end to end
A seller signs in, builds an ad with photos taken in the app, verifies with their ID or passport, passes moderation and is published; a buyer browses freely, verifies once, and reaches the seller on WhatsApp or by phone.
Apply the same verification to your platform
If fake accounts, anonymous sellers or onboarding fraud are costing you, the same gate can be built on what you already run.
🍪 We value your privacy
We use cookies and analytics to understand how you use our site and improve your experience. This includes Google Analytics for tracking site usage.
By clicking "Accept", you consent to analytics tracking. Learn more in our Cookie Policy and Privacy Policy.