Language

04 Jul 2023in Forensics & authentication

A Tricky Part of MRZ Reading: What You Might Overlook

Ihar Kliashchou

Chief Technology Officer, Regula

A machine-readable zone (MRZ) is one of the core security features in passports, ID cards, visas, and many other identity documents. It encodes personal information related to the document’s holder and enables reading and verification of identity documents by machines—hardware or software identity verification (IDV) tools. 

Initially, the MRZ was mainly used to accelerate the document check process at borders and airports. Today, MRZ reading and authentication is also a significant stage in the identity verification process in many businesses.

This guide reveals the details of the MRZ and highlights the subtle nuances of recognizing and reading MRZs.

Stay Tuned

We'll deliver hand-picked content from Regula's experts into your inbox

What is an MRZ code?

Machine-readable zone on a passport

The MRZ is a mandatory element of any identity document

The International Civil Aviation Organization (ICAO) was behind the invention of the machine-readable zone. Countries started issuing travel documents—passports first—with this code back in the 1980s. As of 24 November 2015, non-machine readable passports are considered expired. That means passengers with such travel documents can't visit any of the 193 ICAO Member States.

The machine-readable zone consists of one to three strings of characters—letters, digits, and separators—included on the bottom of the personal data page of a passport, ID card, driver’s license, etc. The location of the code on an identity document depends on the ID type and the issuing authority. You can find the MRZ on either the front or back side.

To implement a single standard for all documents, the ICAO also developed Doc 9303 Machine Readable Travel Documents (MRTDs) with requirements on what data ID documents issued in different countries should include. The document defines MRZ parameters, among other things, including the size of the code's effective reading zone, type font, character size, width spacing, and constant stroke width between characters. Compliance with all these requirements makes MRZ codes easily machine-readable.

According to Doc 9303, MRZs may contain the following information:

  • document number

  • expiration date

  • holder name

  • gender

  • date of birth

  • nationality.

Let’s take a closer look at the data encoded in an MRZ with a Finnish passport as an example.

A personal data page on a Finnish passport with an MRZ code

A Finnish passport has one of the most commonly used MRZ codes

‘P’ at the beginning of the first line indicates the type of document: passport. It might also be ‘V’ for visas, ‘D’ for driver’s licenses, and ‘I’ for ID cards. The code of the issuing authority follows. Typically, it consists of three characters. The full name of the document holder completes the first MRZ line. Fillers (<) are used there and below to fill the remaining space.  

Moving on to the second line, the first nine characters are the document number. Next are the nationality code, date of birth, sex, date of expiry, and personal number (there can be other optional data depending on the document). 

The MRZ code also contains check digits following almost each data set. These values are recalculated and checked by IDV tools and help detect fraud. We’ll come back to them soon.

Machine-readable zones on biometric passports and other e-documents also provide the key to the RFID chip for further NFC-based verification. This data access password is generated based on MRZ fragments like the date of birth, the date of expiry, and the document number. 

What is the purpose of a machine-readable zone?

The main idea behind MRZ reading is to easily verify an individual’s identity and thwart any attempts at accessing systems and territories without authorization. The code consists of specific data in a universal format, i.e., it can be read anywhere with specially designed hardware and software. The MRZ unifies a variety of world alphabets by converting them into plain Latin machine-readable text. 

Being a convenient data format, the MRZ is used not only in identity and travel documents. For instance, you can find this code in vehicle registration certificates (Poland, Bulgaria), work permits (Macau), voter cards (Mexico, Mozambique), etc.

Some states include additional security features in the MRZ by duplicating the code in colors visible only in different spectral ranges. For example, a German passport has two MRZs printed as visible lines and as a kinegram.

A German passport has an machine-readable zone printed as a kinegram

In an Israeli passport, you can see luminescent code in the MRZ under UV light.  

MRZ print changes under different lights on an Israeli passport

Performed in milliseconds, MRZ reading speeds up ID verification at border checkpoints and law enforcement offices, accelerates check-in at airports and hotels, and helps other businesses onboard new customers. Casinos, bank offices, and rental receptions can also be equipped with ID readers or IDV software to check the MRZ in a customer’s document.  

Here are the most common use cases involving MRZ reading:

  • Check-In Automation

  • Data Entry Automation

  • Age Verification  

  • Customer Onboarding 

  • Know Your Customer (KYC) Automation  

  • Fraud Prevention.

Types of machine-readable zones

MRZs can be in different formats depending on the document they are included in. Here are the most common ones:

  • ID1 or TD1 contains one (driver's license) or three lines (typical of ID cards) with 30 characters in each

  • ID2 or TD2 consists of two lines 36 characters long (most often used on visas)

  • ID3 or TD3 also has two lines, but each includes 44 characters (standard for passports).

IDV solution providers typically claim support for all MRZ formats, including non-standard ones. However, if the software isn’t trained to process documents or visas with unusual MRZ types, the system may return an error. 

In addition to the standard types, some countries may use specific MRZ codes in their domestic and travel ID documents. For example, a Swiss driver’s license includes two lines with 30 characters in each.

A Machine-readable Zone on a Swiss driver’s license

A Swiss driver’s license is an example of a non-standard MRZ type

Sometimes, the machine-readable zone can be a hidden element of the document. For example, Visible Digital Seals (VDS)—digitally signed 2D barcodes you can find in Schengen visas—contain an MRZ as one of the components. Recognition and reading of such barcodes are critical steps in a robust document verification flow.

Thus, the vendor's knowledge base is the key to accurately reading and verifying a variety of MRZ codes. 

Now let’s have a look at how the magic works.

Read also: How to Build an Identity Verification System

How do machines read MRZ codes?

The process includes the following steps:

MRZ reading scheme

The main stages of MRZ reading

Step 1. MRZ capture and scanning

First, the machine-readable zone is captured and scanned by passport readers, software powered by an OCR engine, or a user’s mobile camera during digital onboarding. Advanced tools may be helpful when you need to conduct a deeper MRZ authenticity check in different source lights, such as infrared, to reveal overprinting and other signs of forgery.

The higher the image quality and resolution, the better. It helps the algorithms behind the curtain find the MRZ on the scan and extract it for in-depth examination in the next steps. 

Regula’s MRZ reading technology enables capturing a code from any angle. There is no need to position the document in the specific narrow area in front of the mobile camera. The system also effortlessly detects the MRZ in low-res images.

Step 2. Data assessment and extraction

Then, the OCR algorithms extract text data from the image and structure it in an appropriate way. This enables reading and analyzing information encoded in the MRZ—document number, nationality, date of expiry, and all security components, such as check digits that will be verified later.

Here is where parsers come into play. Depending on the size of the MRZ and the number of lines and characters it consists of, they can detect one of the four standard MRZ types or non-standard ones. 

Authorities issuing identity documents can add extra data to the code or alter the format a bit. As a result, there is a need for additional parsers in the IDV vendor’s toolkit that can handle such cases. For instance, Regula Document Reader SDK has about 200+ parsers, including readers for MRZs in residence permits, driver’s licenses, crew member certificates, and other documents issued globally. 

In addition, a robust IDV solution can convert dates into local formats and transliterate names, if needed. 

Step 3. Data verification and cross validation

The decoded data is verified at the final stage. During the process, the meanings of characters, as well as their parameters and placement is taken into account. The system determines whether all the data is appropriate, valid, and conforms to a specific MRZ type.

For instance, document numbers don’t appear as a string of zeros, which is typical for ID specimens, and don't contain placeholders and inappropriate symbols. Regula technology can easily detect discrepancies, as it matches the number format with the document type and the issuing authority. All these checks allow you to confirm the authenticity of the machine-readable zone.

The solution may conduct cross-checks to compare MRZ data with information in the visual inspection zone, such as document number, name, date of birth, country of origin, etc. If any mismatches are detected, the document is considered suspicious. 

The verification also includes the examination of check digits. The fact is that some data portions in the MRZ can be converted to a number by certain arithmetic operations following the ICAO algorithm. This number is a check digit. 

IDV software “knows” how check digits are calculated. This allows machines to compare their calculations with the check digits specified in the code. If any discrepancies are detected, it’s a signal that the document could be forged. 

The data in the MRZ and the RFID chip can be cross-checked at this stage as well. However, not all IDV providers offer this feature. Regula does.

After successfully completing the check, you can be sure that the machine-readable zone has no fraudulent alterations. But additional checks are required to verify the authenticity of this security feature in particular and the identity document as a whole. That’s why MRZ reading is just a single step in a complete document verification flow.

Final thoughts

Initially created for the Aviation sector, MRZ reading technology is now an integral part of the document verification process at many businesses and organizations, as well as government institutions like border control and immigration. 

This technology allows you to fight identity fraud while automating routine procedures to make it easier for your customers and employees. This comes in handy, whether you need to onboard your clients digitally or build a smooth KYC flow.  

However, the system you choose has to be ready to handle a range of non-standard codes used in ID cards around the world. Otherwise, you may encounter a lot of false positives or even missed errors.

Regula software and hardware solutions include MRZ reading capabilities as well. With a large library of parsers for accurate document type detection, they also conduct a number of cross-checks comparing MRZ, visual zone text fields, RFID chip, and barcode data, and report any mismatches if they occur. Moreover, Regula provides advanced authenticity checks for the MRZ and validates different aspects of the MRZ, such as background, width, height, font spacing, and others. 

Request a demo to learn more about the features and capabilities of Regula solutions.

Regula Document Reader SDK

Automate identity document reading
and authentication.

Learn more

FAQ

What is a machine-readable zone?

A machine-readable zone (MRZ) is a code added to the personal data page of an identity document. It usually consists of 1-3 lines of letters and digits, which contain the personal information of the document holder.

What are the types of MRZ?

The most common MRZ types include: 1. ID1—3 lines x 30 characters (typical of ID cards) or 1x30 (most commonly found on driver’s licenses); 2. ID2—2x36 (most often used on visas); 3. ID3—2x44 (standard for passports). In addition, there are a variety of non-standard MRZ codes.

What is the meaning of MRZ?

The MRZ is one of the key security elements of ID documents. Using the code enables unifying and accelerating the verification of travel documents at airports and border control checkpoints.

What is a machine-readable passport?

A machine-readable passport is a travel document that contains a digital code that can be read by automated systems at border checkpoints, airports, etc.

On our website, we use cookies to collect technical information. In particular, we process the IP address of your location to personalize the content of the site

Cookie Policy rules