Why Does SIM Registration Now Use Your Face?

Since July 1, 2026, activating a new mobile number in Indonesia has required facial biometric verification. The policy replaces a process that relied only on a national identity number and family card number, aiming to reduce identity misuse for spam, phishing, fraud, and account takeovers.

Biometric registration is more than taking a selfie. The system needs to confirm that the face belongs to the person whose identity is being registered and that a real person is present in front of the camera.

Why Are Identity Numbers Not Enough?

Identity and family card numbers are information someone knows, not proof that the person is performing the registration. If the data is exposed or used without permission, another party may attempt to register a number under the victim's identity.

Biometrics adds a "who you are" factor to the verification process. The user's face is compared with a reference in the population database, so registration no longer relies only on numbers that can be copied.

How Does the Process Work?

Implementation may vary between operators, but the basic process contains several stages:

1. The user enters their identity number through an operator's app, official website, or service outlet.
2. The camera captures the face with guidance on position and lighting.
3. Liveness detection checks that a real person is present.
4. The system creates a faceprint or numerical representation of facial characteristics.
5. The data is sent for validation against the population reference.
6. The system returns a result: matched, not matched, or retry required.

As of July 5, 2026, Indonesia's Ministry of Communication and Digital Affairs reported that approximately 4.9 million customers had used biometric registration since the voluntary period began, with around 201,000 new-customer transactions per day after full implementation.

Face Recognition Does Not Compare Photos Pixel by Pixel

Facial recognition systems generally identify patterns such as distances between facial features, contours, and other characteristics that a model can read. The result is converted into a sequence of numbers often called a biometric template or faceprint.

The faceprint captured by the camera is compared with the stored reference. The system then produces a similarity score. If the score crosses a defined threshold, the identity can be accepted as a match. If it is too low, the user may be asked to retry or follow another verification process.

That threshold requires balance. A threshold that is too lenient increases the risk of accepting the wrong person. One that is too strict causes legitimate users to be rejected more often because of lighting, camera angle, appearance changes, or device quality.

What Is Liveness Detection?

Face recognition answers the question, "Does this face resemble the reference?" Liveness detection answers another: "Is this a real person who is present now rather than a photograph or recording?"

The system may ask the user to turn their head, smile, blink, or say something. Other implementations analyze texture, lighting changes, depth, and movement patterns without asking for a specific action. The goal is to detect presentation attacks such as printed photos, videos displayed on a screen, or other media attempting to imitate the user.

The ministry states that registration uses liveness detection aligned with biometric testing standards and applies information-security standards. Standards provide evaluation procedures, but they do not make a system immune to every risk.

What Happens If the Face Is Not Detected?

A failed verification does not always indicate an identity problem. It may be caused by a blurred camera, backlighting, a face outside the frame, a disconnected network, or an appearance that differs significantly from the reference photo.

A well-designed system should provide an understandable reason and a specific recovery step. It may ask the user to move to a brighter location, clean the camera, remove an accessory covering the face, or retry through an official service outlet.

How Should Biometric Data Be Protected?

Facial data cannot be replaced as easily as a password. Protection therefore needs to cover the entire workflow: capture, transmission, matching, storage, staff access, activity logging, and deletion according to policy.

Important principles include encryption in transit, role-based access, audit logs, abuse monitoring, clear retention periods, and collecting only the minimum data required.

Users should register only through an operator's official app, website, or outlet. Never send a selfie, identity number, or OTP through a link from an unknown message, as scammers may use the biometric-registration trend as a new reason to conduct phishing.

Lessons for Application Development

Biometric registration demonstrates that digital onboarding must balance security and usability. Strong validation provides little value if instructions are confusing, error messages are unclear, or a failed process offers no path to assistance.

Meta Solusi Digital can help develop web and mobile applications, onboarding flows, API integrations, verification dashboards, and operational systems with attention to data security and user experience. The best solution does more than recognize the right person, it also makes the process transparent and easy to complete.