{"id":35935,"date":"2026-10-09T22:26:07","date_gmt":"2026-10-09T22:26:07","guid":{"rendered":"https:\/\/www.complycube.com\/?p=35935"},"modified":"2026-10-09T22:16:51","modified_gmt":"2026-10-09T22:16:51","slug":"developers-guide-to-mrz-verification","status":"publish","type":"post","link":"https:\/\/www.complycube.com\/zh\/developers-guide-to-mrz-verification\/","title":{"rendered":"A Developer’s Guide to MRZ Verification for KYC"},"content":{"rendered":"
\n

TL;DR: <\/strong>Machine-readable zone (MRZ) verification allows teams to validate identity documents<\/strong> in a standardized format. Learn how a machine-readable zone check<\/strong> can fail, and why an MRZ passport verification<\/strong> does not prove authenticity. Developers can understand how combining checks can build strong verification journeys to prevent fraud.<\/p>\n<\/div>\n\n\n

Why MRZ Verification Alone Cannot Prove Identity<\/h2>\n\n\n\n

Automated identity checks decide whether a customer can open a bank account. Checks also help determine if they can gain access to a fintech service, join a marketplace, or complete any other regulated flow. Developer teams must turn complex evidence into an approve, reject or refer decision in seconds.<\/p>\n\n\n\n

The Machine Readable Zone (MRZ) is helpful because it is predictable. MRZ codes often use a standardized format of key features. They carry structured data, and have mathematical check digits that many automated systems can confirm very quickly. However, a valid MRZ does not necessarily mean a valid identity. One of the main reasons is that MRZ lacks encryption, making it easy to forge.<\/p>\n\n\n\n

\n

MRZ verification tells you whether the data is internally consistent.<\/p>\n<\/blockquote>\n\n\n\n

Mohamed Alsalehi<\/a>, Chief Technical Officer at ComplyCube said, “MRZ does not tell you whether the document is genuine, whether it has been tampered with, or whether the person presenting it is the rightful holder.”<\/p>\n\n\n\n

What Is MRZ Verification for Identity Documents?<\/h2>\n\n\n\n

MRZ is the area of a travel document designed to allow machines to capture a standardized data set. MRZ is a mandatory element of identity documents such as machine-readable travel documents. The International Civil Aviation Organization (ICAO)<\/a> began work on machine-readable documents in 1968 with the first edition of Document 9303 published in 1980. These specifications became the foundational international standards for early machine-readable passports issued by Australia, Canada, and the United States.<\/p>\n\n\n\n

ICAO Document 9303 governs machine-readable travel documents such as passports (TD3), ID cards (TD1\/TD2) and visas. ICAO currently has 193 member states, so MRZ verification can speed up immigration and customs clearance lines.\u00a0<\/p>\n\n\n\n

In real terms, MRZ verification is the process of reading, parsing, and validating a passport’s MRZ codes against its expected structure and respective check digits. Effective MRZ machine reading simplifies automated data capture, reducing manual entry errors and detecting fraud.\u00a0<\/p>\n\n\n\n

What Data Is Encoded in MRZ Codes?<\/h3>\n\n\n\n

MRZ data encoded in a passport includes key identity and document attributes for integrity verification. It often depends on document type and includes personal data such as the document holder’s name, passport number, and date of birth. It also includes information such as nationality, sex, expiration date, issuing country, and any other optional data.\u00a0<\/p>\n\n\n\n

MRZ places these values in fixed positions, which means that software can interpret them consistently. A parser does not have to guess whether six digits represent a date of birth, an expiry date, or a personal number; the document specification defines the field. Other data that also follow standardized formats include the country code and nationality values.\u00a0<\/p>\n\n\n\n

Machines read MRZ codes through Optical Character Recognition (OCR)<\/a> technology. ICAO specifies the OCR-B typeface for machine-readable data. This standardized format helps support an accurate reading across different countries and issuing systems.\u00a0<\/p>\n\n\n\n

MRZ Formats for Passports and ID Cards<\/h3>\n\n\n\n

The three main ICAO formats that developers run into are TD1, TD2, and TD3<\/a>. TD1 is associated with card-sized travel documents and occasionally national identity cards that have three lines of 30 characters. TD2, a slightly smaller card format, uses two lines of 36 characters. TD3, used by machine-readable passports, uses two lines of 44 characters. That is why an MRZ consists of two or three lines depending on the type of document.\u00a0<\/p>\n\n\n\n

Standardized layouts help support global interoperability. However, country-specific or non-standard machine-readable schemes can exist outside of ICAO travel-document standards. Developer teams must then identify the document type before applying parsing rules. <\/p>\n\n\n\n

\"MRZ<\/figure>\n\n\n\n

For some driver’s licenses or vehicle registration certificates, they may contain barcodes or other machine-readable elements. They must not automatically be treated as ICAO MR documents. ICAO 9303<\/a> only governs machine-readable travel documents.<\/p>\n\n\n\n

Additionally, non-machine readable passports and other legacy identity documents need different verification approaches because they do not provide the same standardized MRZ structure. <\/p>\n\n\n\n

How Does MRZ Data Verification Work?<\/h2>\n\n\n\n

The MRZ does more than organize information into predictable positions. Selected fields contain check digits which allow software to find inconsistencies in the data that it has read. The MRZ verification system determines data integrity by applying a mathematical algorithm to the relevant field. So, if the calculated result does not match the digit found within the document, something in the input has changed from what was originally encoded.<\/p>\n\n\n\n

This is pivotal in preventing identity theft, as MRZ helps catch corrupted extraction, transcription errors, or alteration. However, it is a data verification method rather than a full authentication of the overall document.\u00a0<\/p>\n\n\n\n

What is a Checksum in MRZ Verification?<\/h3>\n\n\n\n

A correctly calculated checksum<\/a> shows that specific encoded data is internally consistent. However, it does not prove whether an original document was genuinely issued. Also, it does not show if security features remain intact, valid, or if the person presenting at verification is the real document holder.\u00a0<\/p>\n\n\n\n

Convert Encoded Data Into Numbers<\/h3>\n\n\n\n

Each permitted character from the encoded data is automatically assigned a numerical value. For example, digits 0 through 9 keep their value, letters A through Z map from 10 to 35, and the filler character < is assigned zero. In the case of a document number such as L898902C3, it becomes 21, 8, 9, 8, 9, 0, 2, 12, 3.<\/p>\n\n\n\n

Apply the 7-3-1 Checksum<\/h3>\n\n\n\n
\"Machine<\/figure>\n\n\n\n

Then, ICAO applies a repeating weighting sequence of 7, 3, and 1. Here, each numerical value is multiplied by the corresponding weight, and the sequence continues to repeat until every character in the field has been processed. The document number L898902C3 has a weighted value of 316.<\/p>\n\n\n\n

Calculate the Check Digit<\/h3>\n\n\n\n

The MRZ verification system<\/a> then applies modulo 10, which means that it takes the remainder after dividing the result by 10. In this case, 316 divided by 10 leaves a remainder of 6, making it the expected check digit. If the MRZ contains the exact same digit, the field is then mathematically consistent. If it has a different value, the check fails. This is how checksums help verify the data integrity of MRZ codes.\u00a0<\/p>\n\n\n\n

Individual and Composite Check Digits<\/h3>\n\n\n\n

It is important to understand that a passport MRZ does not rely on just one checksum. Fields that can also provide check digits include the holder’s date of birth and expiration date. A composite check digit also validates a wider combination of MRZ fields.\u00a0<\/p>\n\n\n\n

Check digits<\/a> provide automated systems with more precise information so instead of returning only “MRZ failed”, the verification process can find which field actually caused the data discrepancy. A failed field does not automatically mean that the underlying document is fabricated.\u00a0<\/p>\n\n\n\n

Why Extracted Data Can Fail on Genuine Identity Documents<\/h2>\n\n\n\n

Often, an MRZ checksum is deterministic, but the information that is fed into it may not be. The first point of error is document capture<\/a>. For instance, if a user who completes digital onboarding photographs an ID card or passport with their phone camera, the image may suffer from poor lighting, be at an angle, or have a glare across the MRZ. Good systems guide users to capture clear, well-lit images.<\/p>\n\n\n\n

OCR and Accurate Reading<\/h3>\n\n\n\n

It is the OCR’s responsibility to convert visible MRZ characters into structured data. Even with OCR-B, one individually misrecognized character can change the whole checksum. In some cases, 0 may be confused with an O, 1 with an I, or any other visually similar character can be misread.<\/p>\n\n\n\n

For this reason, MRZ recognition should preserve confidence information instead of immediately converting every data discrepancy into a fraud outcome. A checksum failure from a low-confidence OCR read does not carry the same meaning as a consistent and persisting failure from a clear image with a higher extraction confidence.\u00a0<\/p>\n\n\n\n

Physical Damage and Wear<\/h3>\n\n\n\n

Physical wear<\/a> is another common cause. It can make part of the MRZ completely unreadable to optical scanners. It is common for passports to spend several years moving through pockets, bags, and airports across border checkpoints. Passports can easily develop scratches, creases, dirt, fading, or other damage that can impact capture.\u00a0<\/p>\n\n\n\n

MRZ reduces the problem but does not eliminate it. It just moves the challenge towards capture quality, extraction accuracy, and interpretation. The goal is to understand what a successful checksum actually tells you.\u00a0<\/p>\n\n\n\n

What Does Successful MRZ Verification Actually Prove?<\/h2>\n\n\n\n

A successful checksum only proves that the characters supplied to the algorithm have the correct mathematical relationship as expected by the check digit. It demonstrates internal consistency, but does not prove that the underlying identity document is real. <\/p>\n\n\n\n

A genuine machine-readable passport can occasionally fail an MRZ check<\/a> due to many reasons. This can be because of glare, blur, physical wear, or OCR changing a single character from the extracted data. The National Institute of Standards and Technology (NIST) has up-to-date identity-proofing guidance that separates evidence validation from identity verification.\u00a0You can learn more here: Identity Document OCR for KYC Compliance<\/a>.<\/p>\n\n\n\n

In NIST’s 2025 guidance, identity evidence validation is necessary in order to determine whether evidence is real, correct, and valid. It must also check for signs of counterfeiting and tampering, and for the presence of security features. A strong security system must use MRZ verification along with additional security features or solutions and independent verification methods.\u00a0<\/p>\n\n\n\n

Why MRZ Codes Cannot Establish Document Authenticity<\/h3>\n\n\n\n

MRZ data<\/a> is not encrypted. It is meant to be visible and machine-readable. The checksum algorithm is publicly specified. This is deliberate, to ensure interoperability. It also means the MRZ is not cryptographic proof of origin.<\/p>\n\n\n\n

MRZ data can be copied or altered, and a forger can simply recompute the check digits. In short, a valid checksum does not mean that the document is authentic. This is where another source of information on the same identity document is incredibly useful.<\/p>\n\n\n\n

MRZ, VIZ, and Document Authenticity<\/h2>\n\n\n\n

A passport provides another useful source of data to corroborate against called the Visual Inspection Zone (VIZ)<\/a>. This is the human-readable area that has personal information such as the passport holder’s name, document number, date of issue, date of birth, and expiration date. NIST requires that MRZ or barcode data be checked against printed information on the evidence for consistency where such machine-readable data is present.<\/p>\n\n\n\n

Comparing MRZ Verification Data With the Visual Inspection Zone<\/h3>\n\n\n\n

For example, the MRZ may report one passport number while the VIZ shows another. Sometimes, the inconsistency only becomes visible when the MRZ is compared against an independent representation of the same field. That is why checking identity documents needs verification against more than one dataset.\u00a0<\/p>\n\n\n\n

There are times when a mismatch can have a benign cause such as transliteration or normalization. ICAO notes that names may appear differently in the MRZ simply because they are restricted to a specific OCR-B subset and national characters may need to be transliterated.\u00a0<\/p>\n\n\n\n

The important questions arise around which fields differ, how confidently data can be extracted<\/a> and whether other security measures support one version. This layered logic becomes important in verifying identity documents especially as we move beyond the printed passport itself.\u00a0<\/p>\n\n\n

\n

Case Study: Genuine Passport, Wrong Holder at Border Control<\/strong><\/h3>\n

In June 2026, the Crown Prosecution Service (CPS)<\/a> uncovered a UK-based organized crime group using real Gambian passports to commit fraud. These passports with British visas had been doctored by replacing photographs with those of customers.<\/p>\n

MRZ Verification Checks and Fraud Detection<\/h5>\n

Though a passport can have real underlying document data, it can still be altered or used by someone other than its real passport holder. By combining MRZ verification checks with document-authenticity analysis, teams can detect more fraud.\u00a0<\/p>\n

Outcomes<\/strong><\/h5>\n