Deviation Lists and Defect Lists: Why Genuine ePassports May Fail Authentication

An electronic passport can be genuine, officially issued, and still fail an automated authenticity check during NFC verification. The reason is not always fraud. Sometimes, the problem lies in the passport itself: an incorrectly encoded certificate, an error in the RFID chip's data structure, or another technical deviation introduced during production.

Such errors can affect entire batches of documents. If verification systems are unaware of them, legitimate passport holders may face additional checks, delays, or document rejections. 

Deviation lists and defect lists provide information about known technical problems in electronic machine-readable travel documents (eMRTDs), helping verification systems distinguish documented production errors from potential forgeries.

In this article, we’ll explore how these lists work, what types of errors they cover, and how they help prevent genuine documents from being mistakenly flagged as fraudulent.

To better understand deviation lists and defect lists and their role in electronic document authentication, it is helpful to be familiar with the concept of electronic document verification. For a detailed explanation, see our dedicated articles on RFID verification and certificates for electronic document verification.

An ICAO Deviation List is a digitally signed record of known technical deviations affecting eMRTDs.

ICAO establishes international requirements to ensure that ePassports issued by different countries can be read and authenticated by inspection systems worldwide. In practice, however, production errors can occur. A country might issue a batch of passports with an incorrectly encoded certificate, an inconsistency between files on the chip, or an error in the MRZ. 

If such a problem is discovered after issuance, replacing every affected passport is often difficult and costly. Instead, the issuing country can publish a deviation list identifying the affected documents and describing the known problem. This information can be used when interpreting verification results.

Deviation lists can be published through ICAO PKD or through distribution channels operated by the issuing authority, such as a website or LDAP server.

ICAO defines four main technical categories: 

• Keys and certificates
• Logical Data Structure
• Machine Readable Zone
• RFID chip

Each deviation is identified by an Object Identifier (OID), which enables inspection software to recognize the particular type of problem.

This category covers errors affecting the cryptographic keys and certificates used to authenticate electronic documents.

The LDS determines how information is organized on an ePassport's RFID chip. Errors in this structure can prevent verification systems from reading data correctly or verifying its integrity.

The MRZ is the machine-readable area printed on a passport's data page. It contains standardized information that document readers can extract automatically.

The сhip deviation category covers problems involving the electronic chip itself. For example, passports may contain chips with a manufacturing or implementation defect that affects communication with verification systems. 

ICAO defines three methods for identifying ePassports affected by a known deviation. Each has its advantages and limitations.

The BSI Defect List is another standardized mechanism for handling known technical problems in electronic travel documents. It is defined by Germany's Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, or BSI).

Like ICAO Deviation Lists, BSI Defect Lists address situations in which electronic documents contain errors or do not fully comply with technical requirements. They provide information that inspection systems can use to identify known problems and determine how to handle them during verification.

BSI defines three main categories of defects:

• Authentication Defects: Problems affecting cryptographic authentication mechanisms, including Passive Authentication, Active Authentication, and Chip Authentication. Examples include revoked or incorrectly encoded certificates, compromised authentication keys, and errors that prevent authentication protocols from working correctly.

• Application Defects: Errors in the data and files stored within the ePassport application. For example, data groups may be incorrectly encoded, the Document Security Object (EF.SOD) may contain an invalid signature or incorrect hashes, or the information in EF.COM and EF.SOD may be inconsistent.

• Document Defects: More general problems affecting the document's electronic functionality. These may include incorrectly encoded security objects or chip behavior that requires the reader to reset the chip between successive authentication attempts.

Organizations that verify electronic passports need more than the ability to read RFID chips. Their verification systems must also interpret cryptographic results correctly, including situations involving known technical deviations.

Regula Document Reader SDK supports electronic document processing and authentication, including RFID chip reading, Passive Authentication, and other security mechanisms. Regula Document Reader SDK also supports the integration of ICAO Deviation Lists into electronic document verification workflows.

Authorized organizations can obtain the relevant lists through ICAO PKD or other official distribution channels and make them available to their verification environment. When an electronic passport contains a known deviation, the system can use this information to identify the documented problem rather than treating it as an unexplained verification error.

In one recent example, Regula worked with a deviation list covering more than 300,000 documents, including cases where the hash of DG12 did not match the value stored in EF.SOD. Technical deviations can therefore affect large numbers of issued documents, rather than just isolated cases.

This is particularly important for organizations processing large volumes of identity documents from different countries. Without information about known deviations, legitimate documents affected by production errors may generate additional alerts during NFC verification or require unnecessary manual investigation.

By accounting for recognized deviations, organizations can:

• Reduce false fraud alerts caused by known technical problems in genuine electronic passports.

• Improve verification consistency across documents issued by different countries and authorities.

• Support more informed decisions by distinguishing documented exceptions from unexplained authentication failures.

• Maintain security controls by applying appropriate policies instead of indiscriminately accepting documents with failed checks.

Need to improve your ePassport verification process?

Explore how Regula Document Reader SDK can help you handle complex document verification scenarios.