How to Verify a Passport Like a Pro

Passports are usually packed with security features designed to prevent forgery. Although some countries may have unique features in their passports, the ICAO standardized the major elements, so they should be recognized by anyone involved in document verification. 

Let’s take a closer look at these features and how to verify them.

The Visual Inspection Zone (VIZ) is the area of a passport that contains the holder’s personal details: their name, date of birth, sex, passport number, and photograph. This section is designed for quick and easy visual verification by any examiner, be it a border control officer or a bank clerk.

Note that many passports are written, or at least include fields written in non-Latin scripts, such as Thai documents. The dates can also be written using different calendars: again, in Thailand, it’s the year 2567 right now. When reading such documents with automated means, it’s important for a solution you use to be able to convert the data to a universal format.

What to look for:

• Consistency. Make sure all printed information matches the person presenting the passport. For example, if the holder looks too young for the age stated in the ID, it can be an indirect sign to pay closer attention.

• Photo. Check for signs of photo substitution or tampering.

• Lamination issues. Plastic documents usually don't have film lamination. If they are paper documents, make sure the lamination doesn’t extend beyond the edges of the page. Sometimes, counterfeiters just glue a transparent laminate with a printed photo over the top.

• Signs of wear. Pay attention to unusual page surfaces, thickness, image color density, and contrast between the holder's photo. Any irregularities or unusual damage can be a symptom of alterations.

The machine-readable zone (MRZ) is one, two, or three lines of letters, digits, and separators, which you can typically find at the bottom area in passports, driver’s licenses, and ID cards. The MRZ contains encoded data that matches the information in the VIZ. 

The purpose of the MRZ matches its name: it should enable the document to be read using special devices, such as document readers, thus accelerating the whole process.

What to look for (if you have MRZ reading capabilities):

• Consistency. Ensure the encoded data matches the VIZ. A scanner can quickly read the MRZ and check for any discrepancies.

• Formatting and position. The MRZ should follow standardized formatting as per ICAO guidelines. Any deviations could indicate tampering.

• Check digits. These are parts of data in the MRZ that are calculated following the ICAO algorithm. These values need to be recalculated.

Barcodes in passports are yet another way to present data in a visual, machine-readable form. Barcodes consist of combinations of bars and spaces that correspond to numbers, letters, or other symbols. They can be linear (1D) or two-dimensional (2D), with 2D types storing information both horizontally and vertically.

Barcodes can’t be read and verified manually without using any barcode scanner device or software.

What to look for (if you have a barcode scanner or software):

• Consistency. Compare the scanned data with the VIZ and MRZ. Any mismatches could be a red flag.

• Format. To check barcode authenticity, professional barcode reading technology has to rely on various indirect features: size, location, number of rows and columns, format of recorded data that are specific to this exact document type and series. Even if a barcode has the right data and follows the encoding standards, any unusual patterns, like an unusual number of rows or columns for the specific document, will be flagged for further investigation.

Holograms, also known as diffractive optically variable devices, produce optical effects that change with the angle of observation or illumination. This often creates a dynamic, 3D effect, making holograms difficult to fake and visually striking.

Quite often, holograms resemble nesting dolls. Being a security feature themselves, they may also contain an additional security feature within: nano- or microtext, microimages, covert laser readable images, etc.

What to look for:

• Changes with a change of light angle

• Layering. Genuine holograms are embedded into the document and should not peel off. Check for any signs of tampering or overlays.

Optically variable ink (OVI) is a special type of ink used in passports that change color when you look at it from different angles or lighting. It doesn’t use regular coloring pigments, but instead uses tiny, shiny layers of material that reflect light in different ways.

What to look for:

• Color change. Tilt the passport and observe the color change. Authentic OVI will shift colors smoothly and clearly.

• Consistency with standards. Ensure the color change matches known authentic samples. Familiarize yourself with the specific OVI used in documents of countries you often work with. (For professional use, there’s Regula’s Information Reference System, which serves as a digital encyclopedia of ID documents. There, you can find reference images of passports and their specific security features.)

• Image match. The image formed in this way should have clear boundaries and correspond to the original image, e.g. an RFID sign, text, country contours, etc.

An RFID chip in a passport is a tiny, contactless electronic chip that stores the holder’s personal and biometric data, such as their name, date of birth, and a digital copy of their photograph. The chip and its antenna are embedded within the document, typically in one of the covers, the data page, or a special page when the document is produced. 

The RFID chip can only be read by special document readers used, for example, in airports, or smartphones with an NFC module to quickly verify the passport's information.

What to look for (if you have RFID reading capabilities):

The good news is that when you process RFID with solutions like Regula Document Reader SDK, they instantly flag if there’s anything wrong. In particular, they check:

• Validity of CAN, or card access number. The CAN allows you to access an RFID chip and read a part of the data.

• Validity of MRZ. Just like the CAN, it allows you to access the chip data.

• Validity of signing certificates. The chip data is verified by verifying the digital signature on the document using the public keys of the issuing state. (The details are in our post about electronic certificates.)

• Cloning attacks. It’s essential to make sure that the chip is genuine. To do so, you need to perform active authentication (AA) or chip authentication (CA). The latter is supposed to be more secure, as it employs a more secure protocol for communicating with the chip.

As you can see, passports are designed with a myriad of logical interrelations and regularities. You don’t need to be an expert to check some of them on a basic level, but doing so manually is daunting if possible at all: 

The process often involves complex calculations (e.g., checksums) and deciphering encrypted information (like barcodes). Many security features remain hidden without specialized equipment, and the RFID chip, which contains both important and hard-to-forge data, cannot be verified without the proper tools.

So the effectiveness of passport verification is largely dependent on the technical tools you use. The toolkit may vary depending on the scenario: whether you check passports in your brick-and-mortar office or onboard clients remotely through the Internet.

Onsite passport verification typically happens in various situations where verifying the authenticity of a passport is crucial, like airports. At the same time, there are also use cases when passport verification is necessary, but the main emphasis is on convenience and speed:

• Hotels,

• Car rentals,

• Casinos,

• and more.

The go-to solution for onsite checks is specialized document readers. Typically being desktop-based devices, they instantly read all the data, extract and transfer it to your systems, and confirm both the document’s authenticity and the accuracy of its details.

Remote passport verification is becoming increasingly popular in various scenarios where in-person verification is not feasible, or no longer convenient. This includes remote KYC onboarding of all sorts: in banks, on social networks, employee onboarding, short-term rental, or even getting started on dating apps.

Typically, businesses manage this by enhancing their apps with identity verification capabilities that come as software development kits (SDK) or software-as-a-service platforms (SaaS). SDKs, Regula Document Reader SDK in particular, are more flexible and customizable, while SaaS requires less technical skills to integrate.

To ensure the effectiveness of remote passport verification, there are some requirements for what your solution should be able to do:

→ Verification of document liveness. When it comes to remote passport verification, the first challenge you’ll face is confirming that the submitted document is really an existing authentic document present with the user at the moment of submission. 

→ Reading NFC chips in electronic passports. This is a must-have feature, as almost all countries have electronic documents now, and NFC chip verification is the most secure way out there to confirm document authenticity remotely. If it is known that the presented document is electronic and the user's device can read the chip, it is necessary to do this.

→ Validating and cross-checking data from different sources in a passport. The ideal solution runs an extensive analysis of the captured data, and detects if the passport has the slightest discrepancies from the reference standard, or discrepancies in the data: for example, if the visual zone presents data different from that recorded in the chip, MRZ, or barcode.

→ The fullest supported document coverage. Even if you aren’t a global organization that needs to handle documents from different countries, there are often multiple passport versions by series and type. It's crucial to ensure that your system is updated promptly whenever new passport designs are released (or the old ones go out of circulation).

Being a jack of all trades is useful, but not when it comes to document verification. Mastering this task on your own requires too much effort and takes your focus away from what you do best. Fortunately, there are specialized technical solutions that fully cover the task of passport verification and can turn the chores into a breeze.

Regula offers comprehensive solutions for passport verification, no matter where or how you need to verify documents. Need to eliminate long lines at customer service counters? Regula offers a wide range of document reader devices that are up to the task. Want to integrate identity verification into your apps? Regula Document Reader SDK seamlessly integrates, providing all necessary capabilities while feeling native to your app.

With Regula, you also gain from our extensive experience in document verification. Our solutions are backed by a vast database of documents from around the world, ensuring you can confidently verify passports and other documents.

Contact us today to discover how Regula can help you make document verification more accurate, effective, and secure.