MRZ Verification: The Hidden Challenges Behind a Seemingly Simple Check

A machine-readable zone (MRZ) is one of the core security features in passports, ID cards, visas, and many other identity documents. This guide reveals the details of the MRZ and highlights the subtle nuances of recognizing and reading MRZs.

A machine-readable zone encodes personal information related to the document’s holder and enables reading and verification of identity documents by machines — hardware or software identity verification tools. 

An MRZ code consists of one to three strings of characters — letters, digits, and separators — included on the bottom of the personal data page of a passport, ID card, driver’s license, etc. The location of the code on an identity document depends on the ID type and the issuing authority. You can find the MRZ on either the front or back side. 

Initially, the MRZ was mainly used to accelerate the document check process at borders and airports. Today, MRZ reading and authentication is also a significant stage in the identity verification process in many businesses.

The International Civil Aviation Organization (ICAO) was behind the invention of the machine-readable zone. Countries started issuing travel documents — passports first — with this code back in the 1980s. As of 24 November 2015, non-machine readable passports are considered expired. That means passengers with such travel documents can't visit any of the 193 ICAO Member States.

To implement a single standard for all documents, ICAO also developed Doc 9303 Machine Readable Travel Documents (MRTDs) with requirements on what data ID documents issued in different countries should include. The document defines MRZ parameters, including the size of the code's effective reading zone, type font, character size, width spacing, and constant stroke width between characters. Compliance with all these requirements makes MRZ codes easily machine-readable.

The MRZ is a convenient data format that’s used in more than just identity and travel documents. You can also find this code in vehicle registration certificates (Poland, Bulgaria), work permits (Macau), voter cards (Mexico, Mozambique), etc.

According to Doc 9303, MRZs may contain the following information:

• Document number

• Expiration date

• Holder name

• Gender

• Date of birth

• Nationality

Let’s take a closer look at the data encoded in an MRZ with a Finnish passport as an example.

‘P’ at the beginning of the first line indicates the type of document: passport. It might also be ‘V’ for visas, ‘D’ for driver’s licenses, or ‘I’ for ID cards. The code of the issuing authority follows. Typically, it consists of three characters. The full name of the document holder completes the first MRZ line. Fillers (<) are used there and below to fill the remaining space.  

Moving on to the second line, the first nine characters are the document number. Next are the nationality code, date of birth, sex, date of expiry, and personal number (there can be other optional data depending on the document). 

The MRZ code also contains check digits following almost every data set. These values are recalculated and checked by IDV tools and help detect fraud. We’ll come back to them soon.

Machine-readable zones on biometric passports and other e-documents also provide the key to the RFID chip for further NFC-based verification. This data access password is generated based on MRZ fragments like the date of birth, the date of expiration, and the document number.

In July 2025, ICAO released the updated specifications for the MRZ structure that will be incorporated in the upcoming 9th edition of ICAO Doc 9303. Under the updated approach, all new machine-readable passports must have a two-letter code for a document type.

The update addresses a practical limitation in existing passport MRZs. The first character has long been P, while the second character, when used, may vary by issuing state. Because that second letter was not standardized, automated inspection and verification systems could not always determine the passport type reliably.

For ordinary passports, the new standardized code is PP. Other passport types now have fixed two-letter codes as well.

The transition will happen in stages:

• January 1, 2026 — Adoption of the new codes by the states that already issue passports with a secondary document type indicator. 

• From January 1, 2028 — All states must introduce a mandatory second letter after P for passport types. 

• January 1, 2038 — The expiration date of existing passports with a one-letter MRZ code.

For verification systems, this creates a long coexistence period in which both legacy one-letter passport codes and the new standardized two-letter codes must be recognized and processed correctly.

The main idea behind MRZ reading is to easily verify an individual’s identity and thwart any attempts at accessing systems and territories without authorization. 

The code consists of specific data in a universal format, so it can be read anywhere with specially designed hardware and software. The MRZ unifies a variety of world alphabets by converting them into plain Latin machine-readable text. 

Some states include additional security features in the MRZ by duplicating the code in colors visible only in different spectral ranges. For example, a German passport has two MRZs printed as visible lines and as a kinegram.

In an Israeli passport, you can see a luminescent code in the MRZ under UV light.

The MRZ is useful for verification not only because it stores standardized document data, but also because its physical layout is highly regulated. The ICAO specifications define where the MRZ must appear on the document, how large the characters should be, how much space should separate them, and how the text should behave under infrared examination.

As a result, verification systems can check not only the MRZ data itself, but also whether the code is printed in the right place and in the right way. 

A fraudster may generate an MRZ with fully valid data, yet place it a few millimeters lower than it should be or print it with the wrong spacing. These deviations can be detected and treated as potential signs of forgery.

At the same time, some genuine documents may deviate from the standard in specific ways. If those document-specific exceptions are known, they can also be used in verification logic — the deviation itself becomes an expected feature of that document.

Performed in milliseconds, MRZ scanning speeds up ID verification at border checkpoints and law enforcement offices, accelerates check-in at airports and hotels, and helps other businesses onboard new customers. Casinos, bank offices, and rental receptions can also be equipped with ID readers or identity verification software to check the MRZ in a customer’s document.  

Here are the most common use cases involving MRZ verification:

• Check-In Automation

• Data Entry Automation

• Age Verification  

• Customer Onboarding 

• Know Your Customer (KYC) Automation  

• Fraud Prevention

MRZs can be in different formats depending on the document they are included in. Here are the most common ones:

• ID1 or TD1 contains one (driver's license) or three lines (typical of ID cards) with 30 characters in each.

• ID2 or TD2 consists of two lines 36 characters long (most often used on visas).

• ID3 or TD3 also has two lines, but each includes 44 characters (standard for MRZ passports).

Identity verification solution providers typically claim support for all MRZ formats, including non-standard ones. However, if the software isn’t trained to process documents or visas with unusual MRZ types, the system may return an error. 

In addition to the standard types, some countries may use specific MRZ codes in their domestic and travel ID documents. For example, a Swiss driver’s license includes two lines with 30 characters in each.

Sometimes, the machine-readable zone can be a hidden element of the document. For example, Visible Digital Seals (VDS) — digitally signed 2D barcodes you can find in Schengen visas — contain an MRZ as one of the components. Recognition and reading of such barcodes are critical steps in a robust document verification flow.

Thus, the vendor's knowledge base is the key to accurately reading and verifying a variety of MRZ codes. 

Now let’s have a look at how the magic works.

MRZ reading is a sequence of three tasks: capture, extraction, and verification. A verification system must first isolate the MRZ from the document image, then decode it, and finally verify that the extracted values are internally consistent and match other document data.

Let’s have a closer look at each step.

First, the machine-readable zone is captured and scanned by passport readers, software powered by an OCR engine, or a user’s mobile camera during digital onboarding. Advanced tools may be helpful when you need to conduct a deeper MRZ authenticity check under different source lights, such as infrared, to reveal overprinting and other signs of forgery.

The higher the image quality and resolution, the better. It helps the algorithms find the MRZ on the scan and extract it for in-depth examination in the next steps. 

Regula’s MRZ verification technology can capture a code from any reasonable angle. There is no need to position the document in a specific narrow area in front of the mobile camera. The system also effortlessly detects the MRZ in low-res images.

Then, the OCR algorithms extract text data from the image and structure it in an appropriate way. This enables reading and analyzing information encoded in the MRZ — document number, nationality, date of expiry, and all security components, such as check digits that will be verified later.

Here is where parsers come into play. Depending on the size of the MRZ and the number of lines and characters it consists of, they can detect one of the four standard MRZ types, or non-standard ones. 

Authorities issuing identity documents can add extra data to the code or alter the format a bit. As a result, there is a need for additional parsers in the identity verification solution vendor’s toolkit that can handle such cases. For instance, Regula Document Reader SDK has about 200+ parsers, including ones for MRZs in residence permits, driver’s licenses, crew member certificates, and other documents issued globally. 

In addition, a robust identity verification solution can convert dates into local formats and transliterate names, if needed.

The decoded data is verified at the final stage. During the process, the meanings of characters, as well as their parameters and placement, is taken into account. The system determines whether all the data is appropriate, valid, and conforms to a specific MRZ type.

For instance, document numbers shouldn’t appear as a string of zeros, which is typical for ID specimens, and shouldn't contain placeholders and inappropriate symbols. Regula’s technology can easily detect discrepancies, as it matches the number format with the document type and the issuing authority. All these checks allow you to confirm the authenticity of the machine-readable zone.

The solution may conduct cross-checks to compare MRZ data with information in the visual inspection zone, such as document number, name, date of birth, country of origin, etc. If any mismatches are detected, the document is considered suspicious. 

The verification also includes the examination of check digits. The fact is that some data portions in the MRZ can be converted to a number by certain arithmetic operations following the ICAO algorithm. This number is a check digit. 

Identity verification software “knows” how check digits are calculated. This allows machines to compare their calculations with the check digits specified in the code. If any discrepancies are detected, it’s a signal that the document could be forged. 

The data in the MRZ and the RFID chip can be cross-checked at this stage as well. However, not all identity verification providers offer this feature. Regula does.

After successfully completing the check, you can be sure that the MRZ has no fraudulent alterations. But additional checks are required to verify the authenticity of this security feature in particular and the identity document as a whole. That’s why MRZ reading is just a single step in a complete document verification flow.

Initially created for the aviation sector, MRZ reading technology is now an integral part of the document verification process at many businesses and organizations, as well as government institutions like border control and immigration. 

This technology allows you to fight identity fraud while automating routine procedures to make it easier for your customers and employees. This comes in handy, whether you need to onboard your clients digitally or build a smooth KYC flow. 

However, the system you choose has to be ready to handle a range of non-standard codes used in ID cards around the world. Otherwise, you may encounter a lot of false positives or even missed errors.

Regula software and hardware solutions include MRZ reading capabilities as well. With a large library of parsers for accurate document type detection, they also conduct a number of cross-checks comparing MRZ, visual zone text fields, RFID chip, and barcode data, and report any mismatches if they occur. Moreover, Regula provides advanced authenticity checks for the MRZ and validates different aspects of the MRZ, such as background, width, height, font spacing, and others. 

Request a demo to learn more about the features and capabilities of Regula solutions.