A verifiable credential is a W3C-standardized digital credential, an attribute set about a subject, signed by an issuer, that any verifier can check cryptographically without contacting the issuer. VCs separate the three roles (issuer, holder, verifier) so a person can carry proof of a fact and present it where needed, with the signature carrying the trust.
The separation of roles is what removes the phone-home. A verifier that can check a signature against a published issuer key learns the claim is authentic without telling the issuer who is presenting it or when, which is a privacy property and an availability one.
What signatures cannot carry is currency. A credential signed last year is still validly signed today, so revocation needs a separate mechanism, and binding the credential to a live signal at use time is a separate question again.
Removing the phone-home is a privacy property and an availability one at the same time. A verifier checking a signature against a published issuer key learns the claim is authentic without telling the issuer who presented it or when, and it keeps working when the issuer is unreachable, which matters for credentials presented years after issuance.
Currency is what a signature cannot carry, and it is the gap every deployment has to close separately. A credential signed last year is still validly signed today, so revocation needs its own mechanism, and the available designs trade privacy against freshness: a status list is cheap and leaks little, while a live status check tells the issuer exactly when a credential was used.
Binding is the third question and the one most relevant to fraud. A credential proves an attribute was attested at issuance; whether the person presenting it still controls the account, the device and the phone line behind it is a separate check, which is why wallet credentials pair naturally with live trust signals rather than replacing them. Formats such as SD-JWT address what is revealed, not whether the holder is still the subject.
PasskeyBridge verifies identity signals like these inside the request, with zero PII stored. See how the platform works or test the live API.