A Developer’s Guide to MRZ Verification for KYC

Why MRZ Verification Alone Cannot Prove Identity

Automated identity checks decide whether a customer can open a bank account. Checks also help determine if they can gain access to a fintech service, join a marketplace, or complete any other regulated flow. Developer teams must turn complex evidence into an approve, reject or refer decision in seconds.

The Machine Readable Zone (MRZ) is helpful because it is predictable. MRZ codes often use a standardized format of key features. They carry structured data, and have mathematical check digits that many automated systems can confirm very quickly. However, a valid MRZ does not necessarily mean a valid identity. One of the main reasons is that MRZ lacks encryption, making it easy to forge.

MRZ verification tells you whether the data is internally consistent.

محمد الصالحي, Chief Technical Officer at ComplyCube said, “MRZ does not tell you whether the document is genuine, whether it has been tampered with, or whether the person presenting it is the rightful holder.”

What Is MRZ Verification for Identity Documents?

MRZ is the area of a travel document designed to allow machines to capture a standardized data set. MRZ is a mandatory element of identity documents such as machine-readable travel documents. The International Civil Aviation Organization (ICAO) began work on machine-readable documents in 1968 with the first edition of Document 9303 published in 1980. These specifications became the foundational international standards for early machine-readable passports issued by Australia, Canada, and the United States.

ICAO Document 9303 governs machine-readable travel documents such as passports (TD3), ID cards (TD1/TD2) and visas. ICAO currently has 193 member states, so MRZ verification can speed up immigration and customs clearance lines. 

In real terms, MRZ verification is the process of reading, parsing, and validating a passport’s MRZ codes against its expected structure and respective check digits. Effective MRZ machine reading simplifies automated data capture, reducing manual entry errors and detecting fraud. 

What Data Is Encoded in MRZ Codes?

MRZ data encoded in a passport includes key identity and document attributes for integrity verification. It often depends on document type and includes personal data such as the document holder’s name, passport number, and date of birth. It also includes information such as nationality, sex, expiration date, issuing country, and any other optional data. 

MRZ places these values in fixed positions, which means that software can interpret them consistently. A parser does not have to guess whether six digits represent a date of birth, an expiry date, or a personal number; the document specification defines the field. Other data that also follow standardized formats include the country code and nationality values. 

Machines read MRZ codes through التعرف البصري على الحروف (OCR) technology. ICAO specifies the OCR-B typeface for machine-readable data. This standardized format helps support an accurate reading across different countries and issuing systems. 

MRZ Formats for Passports and ID Cards

The three main ICAO formats that developers run into are TD1, TD2, and TD3. TD1 is associated with card-sized travel documents and occasionally national identity cards that have three lines of 30 characters. TD2, a slightly smaller card format, uses two lines of 36 characters. TD3, used by machine-readable passports, uses two lines of 44 characters. That is why an MRZ consists of two or three lines depending on the type of document. 

Standardized layouts help support global interoperability. However, country-specific or non-standard machine-readable schemes can exist outside of ICAO travel-document standards. Developer teams must then identify the document type before applying parsing rules. 

For some driver’s licenses or vehicle registration certificates, they may contain barcodes or other machine-readable elements. They must not automatically be treated as ICAO MR documents. ICAO 9303 only governs machine-readable travel documents.

Additionally, non-machine readable passports and other legacy identity documents need different verification approaches because they do not provide the same standardized MRZ structure.

How Does MRZ Data Verification Work?

The MRZ does more than organize information into predictable positions. Selected fields contain check digits which allow software to find inconsistencies in the data that it has read. The MRZ verification system determines data integrity by applying a mathematical algorithm to the relevant field. So, if the calculated result does not match the digit found within the document, something in the input has changed from what was originally encoded.

This is pivotal in preventing identity theft, as MRZ helps catch corrupted extraction, transcription errors, or alteration. However, it is a data verification method rather than a full authentication of the overall document. 

What is a Checksum in MRZ Verification?

A correctly calculated checksum shows that specific encoded data is internally consistent. However, it does not prove whether an original document was genuinely issued. Also, it does not show if security features remain intact, valid, or if the person presenting at verification is the real document holder. 

Convert Encoded Data Into Numbers

Each permitted character from the encoded data is automatically assigned a numerical value. For example, digits 0 through 9 keep their value, letters A through Z map from 10 to 35, and the filler character < is assigned zero. In the case of a document number such as L898902C3, it becomes 21, 8, 9, 8, 9, 0, 2, 12, 3.

Apply the 7-3-1 Checksum

Then, ICAO applies a repeating weighting sequence of 7, 3, and 1. Here, each numerical value is multiplied by the corresponding weight, and the sequence continues to repeat until every character in the field has been processed. The document number L898902C3 has a weighted value of 316.

Calculate the Check Digit

ال MRZ verification system then applies modulo 10, which means that it takes the remainder after dividing the result by 10. In this case, 316 divided by 10 leaves a remainder of 6, making it the expected check digit. If the MRZ contains the exact same digit, the field is then mathematically consistent. If it has a different value, the check fails. This is how checksums help verify the data integrity of MRZ codes. 

Individual and Composite Check Digits

It is important to understand that a passport MRZ does not rely on just one checksum. Fields that can also provide check digits include the holder’s date of birth and expiration date. A composite check digit also validates a wider combination of MRZ fields. 

Check digits provide automated systems with more precise information so instead of returning only “MRZ failed”, the verification process can find which field actually caused the data discrepancy. A failed field does not automatically mean that the underlying document is fabricated. 

Why Extracted Data Can Fail on Genuine Identity Documents

Often, an MRZ checksum is deterministic, but the information that is fed into it may not be. The first point of error is document capture. For instance, if a user who completes digital onboarding photographs an ID card or passport with their phone camera, the image may suffer from poor lighting, be at an angle, or have a glare across the MRZ. Good systems guide users to capture clear, well-lit images.

OCR and Accurate Reading

It is the OCR’s responsibility to convert visible MRZ characters into structured data. Even with OCR-B, one individually misrecognized character can change the whole checksum. In some cases, 0 may be confused with an O, 1 with an I, or any other visually similar character can be misread.

For this reason, MRZ recognition should preserve confidence information instead of immediately converting every data discrepancy into a fraud outcome. A checksum failure from a low-confidence OCR read does not carry the same meaning as a consistent and persisting failure from a clear image with a higher extraction confidence. 

Physical Damage and Wear

Physical wear is another common cause. It can make part of the MRZ completely unreadable to optical scanners. It is common for passports to spend several years moving through pockets, bags, and airports across border checkpoints. Passports can easily develop scratches, creases, dirt, fading, or other damage that can impact capture. 

MRZ reduces the problem but does not eliminate it. It just moves the challenge towards capture quality, extraction accuracy, and interpretation. The goal is to understand what a successful checksum actually tells you. 

What Does Successful MRZ Verification Actually Prove?

A successful checksum only proves that the characters supplied to the algorithm have the correct mathematical relationship as expected by the check digit. It demonstrates internal consistency, but does not prove that the underlying identity document is real. 

A genuine machine-readable passport can occasionally fail an MRZ check due to many reasons. This can be because of glare, blur, physical wear, or OCR changing a single character from the extracted data. The National Institute of Standards and Technology (NIST) has up-to-date identity-proofing guidance that separates evidence validation from identity verification. You can learn more here: Identity Document OCR for KYC Compliance.

In NIST’s 2025 guidance, identity evidence validation is necessary in order to determine whether evidence is real, correct, and valid. It must also check for signs of counterfeiting and tampering, and for the presence of security features. A strong security system must use MRZ verification along with additional security features or solutions and independent verification methods. 

Why MRZ Codes Cannot Establish Document Authenticity

MRZ data is not encrypted. It is meant to be visible and machine-readable. The checksum algorithm is publicly specified. This is deliberate, to ensure interoperability. It also means the MRZ is not cryptographic proof of origin.

MRZ data can be copied or altered, and a forger can simply recompute the check digits. In short, a valid checksum does not mean that the document is authentic. This is where another source of information on the same identity document is incredibly useful.

MRZ, VIZ, and Document Authenticity

A passport provides another useful source of data to corroborate against called the منطقة الفحص البصري (VIZ). This is the human-readable area that has personal information such as the passport holder’s name, document number, date of issue, date of birth, and expiration date. NIST requires that MRZ or barcode data be checked against printed information on the evidence for consistency where such machine-readable data is present.

Comparing MRZ Verification Data With the Visual Inspection Zone

For example, the MRZ may report one passport number while the VIZ shows another. Sometimes, the inconsistency only becomes visible when the MRZ is compared against an independent representation of the same field. That is why checking identity documents needs verification against more than one dataset. 

There are times when a mismatch can have a benign cause such as transliteration or normalization. ICAO notes that names may appear differently in the MRZ simply because they are restricted to a specific OCR-B subset and national characters may need to be transliterated. 

The important questions arise around which fields differ, how confidently data can be extracted and whether other security measures support one version. This layered logic becomes important in verifying identity documents especially as we move beyond the printed passport itself. 

Identity Verification Is Moving Beyond the Physical Passport

Modern identity verification also looks at electronic and biometric signals. For example, the EU Entry/Exit system (EES) records travel document data along with facial images and fingerprints for eligible non-EU travellers at external Schengen borders. 

In terms of border control, identity checks need not rely on visual inspection or stamps on a physical travel document. Biometric information used along with document information can improve identification to help combat identity fraud. 

Biometric Passports and Chip Data

Modern biometric passports add a layer through an embedded contactless chip. ICAO’s logical data structure specifies that the chip contains Data Group 1 with MRZ information, while other groups can hold biometric and supporting data.

Unlike a checksum, chip data can be subjected to cryptographic verification. Systems can verify the chip’s data integrity and issuing authority. Chip verification doesn’t replace MRZ. MRZ remains the fast, standardised first step that is used to derive the access key for the Near-Field Communication (NFC) chip read. نفك is a short-range wireless technology that lets two electronic devices communicate and share data. Chip verification allows for stronger evidence about digital provenance. 

MRZ Verification in a Secure Identity Verification Process

In a secure identity verification workflow, MRZ is one layer in a chain of identity evidence. The first stage is document capture where the system determines whether the passport or identity card has been captured clearly enough for processing. Next, OCR and MRZ recognition convert the document into extracted data in a structured machine-readable format. The system then checks the expected MRZ format and validates check digits. 

Then, overlapping MRZ and VIZ fields are compared. Document authenticity technology or software can assess other security features for any signs of manipulation. For supported biometric passports, نفك can provide access to cryptographically protected chip data. Finally, facial comparison and liveness can establish that the applicant is the real holder of the identity. 

The UK’s 2026 Digital Verification Services Trust (DVST) Framework reflects this approach. It lists passport-chip reading, identity-fraud services and biometric verification as specialist capabilities. MRZ delivers the most value by accelerating the early stages of identity checking without pretending to answer every downstream trust question.

MRZ codes also help facilitate customer onboarding within financial institutions because onboarding has to balance speed, fraud controls, and larger اعرف عميلك (KYC) obligations. MRZ verification can automate KYC checks for banks and applications. However, it cannot replace document-authenticity checks, biometric verification, or other risk controls. 

5 MRZ Verification Mistakes Developers Should Avoid

Though MRZ verification and codes are simple at the checksum level, there are larger implementation challenges that come with it for developer teams. They especially struggle when deciding what the MRZ verification result means in context. Here are five MRZ verification mistakes that developers must avoid:

Treating a Failed Checksum as Fraud:

A failed checksum signals an inconsistency but not its cause. Often, the cause is a glare, blur, a worn-out passport, or an OCR engine that misreads a single character. Here, developers must check capture quality and OCR confidence before drawing any conclusion. A failure on low-confidence must trigger a recapture request. Developers must use field-level results to see which field failed, instead of returning a generic “MRZ failed”.

Treating a Passing Checksum as Proof of Authenticity:

MRZ checksums are often used to prove internal consistency, but not origin. MRZ verification was designed for interoperable data verification, so developer teams must not use it as a singular source of authentication. Data is unencrypted and the algorithm is public. Pair it with document-authenticity analysis, biometric matching, and liveness detection. Do not let MRZ alone make the final approval decision.

Not Comparing MRZ and VIZ Data:

MRZ and VIZ carry overlapping fields of information. If you only read one, an altered field can slip through the cracks. Mismatches between the two is one of the clearest signals that you can get from the document itself. It is important to extract both zones and compare. Look at benign differences first and flag what matters. Weigh them alongside extraction confidence and other security checks.

Collapsing Results into a Single Pass/Fail Value: 

Boiling every outcome down to one disregards the information you need to make a good decision later on. A clean pass, a pass on low-quality images, and a field-level mismatch can all look the same once flattened. Store capture quality, OCR confidence, field-level check results, and MRZ/VIZ comparison outcomes as separate signals. Use them to build a risk-based decision with three outcomes: approve, reject, or refer.

Skipping Chip and Biometric Checks Where Available: 

Though MRZ cannot prove origin, a biometric passport’s chip can. Chip data can be verified for integrity and issuing authority. The MRZ can be used to derive the acces key for reading it over NFC. Developers should add chip reading, face matching, and liveness detection to flows where the document and devices can support it. MRZ should be used as the standardized first step, not just the last one.

Building Reliable MRZ Verification for KYC

Strong MRZ verification goes beyond validating a checksum. ComplyCube brings MRZ verification and validation together with document-authenticity checks. Our platform also checks MRZ and VIZ consistency, biometric face matching, liveness detection, and NFC verification where supported. Configurable risk decisioning helps businesses build a more thorough identity verification process. 

Developers can combine these signals into one workflow by separating the technical extraction problems from genuine risk signals. This reduces the need for manual review and strengthens fraud prevention without adding friction for the users during digital onboarding. Use MRZ alongside additional security measures to support faster and more reliable KYC decisions with ComplyCube.