Layered security for age verification and transaction authorization

A system comprising:

• a user device comprising:
• a processor, and
• a memory storing programmable instructions, when executed by the processor, cause the processor to perform operations comprising:
• initiating a transaction application configured to interact with a service provider interface;
• acquiring, via the transaction application, biometric data of a user;
• comparing the biometric data of the user with prior user data stored on a credential issued to the user;
• verifying that the biometric data of the user matches the prior user data;
• establishing an encrypted communications tunnel between the service provider interface and the transaction application;
• transmitting the prior user data with attributes of the service provider interface to a server configured to operate separately from the service provider interface;
• receiving verification data corresponding to the attributes of the service provider interface from the server;
• authenticating the service provider interface and the user with the server;
• and
• establishing an encrypted session between the service provider interface and the transaction application.

A non-transitory machine-readable medium comprising a plurality of machine-readable instructions and a transaction application, when executed by one or more processors of a user device, cause the user device to perform operations comprising:

• acquiring, via the transaction application configured to interact with a service provider interface, biometric data of a user;
• comparing the biometric data of the user with prior user data stored on a credential issued to the user;
• verifying that the biometric data of the user matches the prior user data;
• establishing an encrypted communications tunnel between the service provider interface and the transaction application;
• transmitting the prior user data with attributes of the service provider interface to a trusted server configured to operate separately from the service provider interface;
• receiving verification data corresponding to the attributes of the service provider interface from the trusted server;
• authenticating the service provider interface and the user with the trusted server;
• and
• establishing an encrypted session between the service provider interface and the transaction application.