A Tricky Part of MRZ Reading: What You Might Overlook

The International Civil Aviation Organization (ICAO) was behind the invention of the machine-readable zone. Countries started issuing travel documents—passports first—with this code back in the 1980s. As of 24 November 2015, non-machine readable passports are considered expired. That means passengers with such travel documents can't visit any of the 193 ICAO Member States.

The machine-readable zone consists of one to three strings of characters—letters, digits, and separators—included on the bottom of the personal data page of a passport, ID card, driver’s license, etc. The location of the code on an identity document depends on the ID type and the issuing authority. You can find the MRZ on either the front or back side.

To implement a single standard for all documents, the ICAO also developed Doc 9303 Machine Readable Travel Documents (MRTDs) with requirements on what data ID documents issued in different countries should include. The document defines MRZ parameters, among other things, including the size of the code's effective reading zone, type font, character size, width spacing, and constant stroke width between characters. Compliance with all these requirements makes MRZ codes easily machine-readable.

According to Doc 9303, MRZs may contain the following information:

• document number

• expiration date

• holder name

• gender

• date of birth

• nationality.

Let’s take a closer look at the data encoded in an MRZ with a Finnish passport as an example.

‘P’ at the beginning of the first line indicates the type of document: passport. It might also be ‘V’ for visas, ‘D’ for driver’s licenses, and ‘I’ for ID cards. The code of the issuing authority follows. Typically, it consists of three characters. The full name of the document holder completes the first MRZ line. Fillers (<) are used there and below to fill the remaining space.  

Moving on to the second line, the first nine characters are the document number. Next are the nationality code, date of birth, sex, date of expiry, and personal number (there can be other optional data depending on the document). 

The MRZ code also contains check digits following almost each data set. These values are recalculated and checked by IDV tools and help detect fraud. We’ll come back to them soon.

Machine-readable zones on biometric passports and other e-documents also provide the key to the RFID chip for further NFC-based verification. This data access password is generated based on MRZ fragments like the date of birth, the date of expiry, and the document number. 

The main idea behind MRZ reading is to easily verify an individual’s identity and thwart any attempts at accessing systems and territories without authorization. The code consists of specific data in a universal format, i.e., it can be read anywhere with specially designed hardware and software. The MRZ unifies a variety of world alphabets by converting them into plain Latin machine-readable text. 

Being a convenient data format, the MRZ is used not only in identity and travel documents. For instance, you can find this code in vehicle registration certificates (Poland, Bulgaria), work permits (Macau), voter cards (Mexico, Mozambique), etc.

Some states include additional security features in the MRZ by duplicating the code in colors visible only in different spectral ranges. For example, a German passport has two MRZs printed as visible lines and as a kinegram.

In an Israeli passport, you can see luminescent code in the MRZ under UV light.  

Performed in milliseconds, MRZ reading speeds up ID verification at border checkpoints and law enforcement offices, accelerates check-in at airports and hotels, and helps other businesses onboard new customers. Casinos, bank offices, and rental receptions can also be equipped with ID readers or IDV software to check the MRZ in a customer’s document.  

Here are the most common use cases involving MRZ reading:

• Check-In Automation

• Data Entry Automation

• Age Verification  

• Customer Onboarding 

• Know Your Customer (KYC) Automation  

• Fraud Prevention.

MRZs can be in different formats depending on the document they are included in. Here are the most common ones:

• ID1 or TD1 contains one (driver's license) or three lines (typical of ID cards) with 30 characters in each

• ID2 or TD2 consists of two lines 36 characters long (most often used on visas)

• ID3 or TD3 also has two lines, but each includes 44 characters (standard for passports).

IDV solution providers typically claim support for all MRZ formats, including non-standard ones. However, if the software isn’t trained to process documents or visas with unusual MRZ types, the system may return an error. 

In addition to the standard types, some countries may use specific MRZ codes in their domestic and travel ID documents. For example, a Swiss driver’s license includes two lines with 30 characters in each.

Sometimes, the machine-readable zone can be a hidden element of the document. For example, Visible Digital Seals (VDS)—digitally signed 2D barcodes you can find in Schengen visas—contain an MRZ as one of the components. Recognition and reading of such barcodes are critical steps in a robust document verification flow.

Thus, the vendor's knowledge base is the key to accurately reading and verifying a variety of MRZ codes. 

Now let’s have a look at how the magic works.

The process includes the following steps:

First, the machine-readable zone is captured and scanned by passport readers, software powered by an OCR engine, or a user’s mobile camera during digital onboarding. Advanced tools may be helpful when you need to conduct a deeper MRZ authenticity check in different source lights, such as infrared, to reveal overprinting and other signs of forgery.

The higher the image quality and resolution, the better. It helps the algorithms behind the curtain find the MRZ on the scan and extract it for in-depth examination in the next steps. 

Regula’s MRZ reading technology enables capturing a code from any angle. There is no need to position the document in the specific narrow area in front of the mobile camera. The system also effortlessly detects the MRZ in low-res images.

Then, the OCR algorithms extract text data from the image and structure it in an appropriate way. This enables reading and analyzing information encoded in the MRZ—document number, nationality, date of expiry, and all security components, such as check digits that will be verified later.

Here is where parsers come into play. Depending on the size of the MRZ and the number of lines and characters it consists of, they can detect one of the four standard MRZ types or non-standard ones. 

Authorities issuing identity documents can add extra data to the code or alter the format a bit. As a result, there is a need for additional parsers in the IDV vendor’s toolkit that can handle such cases. For instance, Regula Document Reader SDK has about 200+ parsers, including readers for MRZs in residence permits, driver’s licenses, crew member certificates, and other documents issued globally. 

In addition, a robust IDV solution can convert dates into local formats and transliterate names, if needed. 

The decoded data is verified at the final stage. During the process, the meanings of characters, as well as their parameters and placement is taken into account. The system determines whether all the data is appropriate, valid, and conforms to a specific MRZ type.

For instance, document numbers don’t appear as a string of zeros, which is typical for ID specimens, and don't contain placeholders and inappropriate symbols. Regula technology can easily detect discrepancies, as it matches the number format with the document type and the issuing authority. All these checks allow you to confirm the authenticity of the machine-readable zone.

The solution may conduct cross-checks to compare MRZ data with information in the visual inspection zone, such as document number, name, date of birth, country of origin, etc. If any mismatches are detected, the document is considered suspicious. 

The verification also includes the examination of check digits. The fact is that some data portions in the MRZ can be converted to a number by certain arithmetic operations following the ICAO algorithm. This number is a check digit. 

IDV software “knows” how check digits are calculated. This allows machines to compare their calculations with the check digits specified in the code. If any discrepancies are detected, it’s a signal that the document could be forged. 

The data in the MRZ and the RFID chip can be cross-checked at this stage as well. However, not all IDV providers offer this feature. Regula does.

After successfully completing the check, you can be sure that the machine-readable zone has no fraudulent alterations. But additional checks are required to verify the authenticity of this security feature in particular and the identity document as a whole. That’s why MRZ reading is just a single step in a complete document verification flow.

Initially created for the Aviation sector, MRZ reading technology is now an integral part of the document verification process at many businesses and organizations, as well as government institutions like border control and immigration. 

This technology allows you to fight identity fraud while automating routine procedures to make it easier for your customers and employees. This comes in handy, whether you need to onboard your clients digitally or build a smooth KYC flow.  

However, the system you choose has to be ready to handle a range of non-standard codes used in ID cards around the world. Otherwise, you may encounter a lot of false positives or even missed errors.

Regula software and hardware solutions include MRZ reading capabilities as well. With a large library of parsers for accurate document type detection, they also conduct a number of cross-checks comparing MRZ, visual zone text fields, RFID chip, and barcode data, and report any mismatches if they occur. Moreover, Regula provides advanced authenticity checks for the MRZ and validates different aspects of the MRZ, such as background, width, height, font spacing, and others. 

Request a demo to learn more about the features and capabilities of Regula solutions.