Document Verification: Which Checks Catch a Forgery
The checks inside a document verification product differ by orders of magnitude in how hard they are to defeat. This ranks all seven, from the MRZ check digit a forger recomputes with a pen to the chip signature that needs a sovereign private key.
Document verification confirms that an identity document is genuine and that its printed data has not been altered. A modern system matches the document against a template for that exact ID type, reads the machine-readable zone, inspects the security features, and returns a decision in 30 seconds.
Here is a machine-readable zone. It belongs to the specimen passport ICAO publishes for the fictional state of Utopia, which is why it is safe to print:
P<UTOERIKSSON<<ANNA<MARIA<<<<<<<<<<<<<<<<<<<
L898902C36UTO7408122F1204159ZE184226B<<<<<10
"MRZ checksum validation" appears routinely in this category's published lists of fraud checks. That check will pass on the line above. It will also pass if I alter the document number and reissue it, because I can recompute the checksum myself, with a pen, in about a minute.
Checksums are fine. What the category says about them is the problem. The checks inside a document verification product are not on one scale at all: one costs a forger a minute with a pen, another costs him a national signing key. Most buyer's guides present them as a flat list of bullet points, as though verifying arithmetic and verifying a sovereign signature were comparable achievements.
So here they are ranked instead, weakest first.
What is document verification?
Document verification establishes that an identity document is authentic, unaltered, and issued to the person presenting it. It runs three broad families of check: data integrity, which confirms the document's own fields agree with each other; physical authenticity, which confirms the document was manufactured by the issuing authority; and, where a chip is present, cryptographic authenticity.
Check 3 on the list below is template conformance, and it is the check that fails silently when a system has never seen the document in front of it. That makes the reference library the actual product. Authenticate's covers 6,500+ government ID types across 200+ countries, with identity verification running in 203, and the Medallion™ flow presenting in 38 languages. You cannot spot a wrong font on a Latvian identity card without knowing what the right one looks like, and nobody knows that from first principles.
What does the MRZ check digit actually prove?
The MRZ check digit proves that the line was transcribed correctly. Nothing more. It is an error-detecting code, and it does the job error-detecting codes do: it catches a misread character, a transposed pair, an OCR failure. It was never designed to resist an adversary, and it does not.
The algorithm is public. According to ICAO Doc 9303, Part 3, the specification that governs machine-readable travel documents worldwide, it works like this. Each character gets a value: digits are themselves, letters run A=10 through Z=35, and the filler character < is zero. Multiply each character by a repeating weight of 7, 3, 1. Sum the products. The check digit is that sum modulo 10.
The document number in the specimen above is L898902C3 and its published check digit is 6. Working it through:
| Character | Value | Weight | Product | Running total |
|---|---|---|---|---|
| L | 21 | 7 | 147 | 147 |
| 8 | 8 | 3 | 24 | 171 |
| 9 | 9 | 1 | 9 | 180 |
| 8 | 8 | 7 | 56 | 236 |
| 9 | 9 | 3 | 27 | 263 |
| 0 | 0 | 1 | 0 | 263 |
| 2 | 2 | 7 | 14 | 277 |
| C | 12 | 3 | 36 | 313 |
| 3 | 3 | 1 | 3 | 316 |
316 modulo 10 is 6, which matches.
Stated as a single fact, so it can travel: the ICAO Doc 9303 check digit for document number L898902C3 is 6, because the 7-3-1 weighted values of its characters sum to 316 and 316 modulo 10 is 6. Change the number to L898902C9 and the sum becomes 322, making 2 the correct digit. The check digit is an error-detecting code, not an anti-forgery control.
The same method reproduces the other four check digits in that specimen: the date of birth, the expiry date, the personal number, and the composite digit. That last one is worth a note, because it is the reason the forgery below takes two steps rather than one: the composite covers 39 of the line's 44 characters, skipping the issuing state code and the sex field. All five agree with ICAO's published values.
Now the part that matters. Change the document number from L898902C3 to L898902C9. Run the same arithmetic and its check digit becomes 2. The composite digit covers the document number as well, so recompute that too: it becomes 8. The forged line reads:
L898902C92UTO7408122F1204159ZE184226B<<<<<18
Every checksum validator in the world will confirm that line is valid, because it is. Two digits of pen arithmetic instead of one. The document is forged and the checksums are correct, and there is no tension between those two facts.
Authenticate validates MRZ check digits too. It should be clear by now what that buys: confidence that the machine read the line correctly, which is worth having, and no evidence whatsoever about whether the document is real.
What is the MRZ checksum for?
The checksum exists to catch the verification pipeline's own mistakes: bad lighting, a smudged document, an OCR engine that guessed wrong, a thumb over the last character. That is a smaller claim than "fraud detection" and a more useful one than it sounds, because the failure it prevents is the one that quietly costs you real customers.
Consider the failure it prevents. A user photographs a passport in poor light, the reader misinterprets a 0 as an O, and the document number now differs by one character from the one on file. Without a checksum, that becomes a false rejection, or worse, a record filed against a document number that does not exist. The check digit catches it immediately and the flow can prompt for a better photograph instead of declining a legitimate user.
That is the correct way to think about most of the data-integrity layer. It protects the honest user from the imaging pipeline. Forgers walk straight past it.
Which checks does a forger have to defeat?
A forger has to defeat seven checks, and they are nowhere near equivalent. What matters about any document check is not what it inspects but what a forger must acquire in order to pass it, because that is what decides whether the check stops anybody. Ranked by that test, from trivial to effectively impossible:
| # | Check | What it proves | What a forger needs to defeat it |
|---|---|---|---|
| 1 | MRZ or barcode check digit | The line was read correctly | Arithmetic |
| 2 | MRZ against the printed fields | The two data zones agree | Care. Edit both, not one |
| 3 | Template conformance for that ID type | The layout matches the issuing authority's design | The correct template among thousands, for the right country and the right issue year |
| 4 | Print technique and font analysis | The data was printed the way the issuer prints it | Reproduction equipment the issuer uses |
| 5 | Hologram and optically variable device response | A feature that changes with viewing angle behaves correctly | Manufacturing capability, not a printer |
| 6 | UV and IR feature response | The substrate and inks react correctly outside visible light | Control of materials chemistry |
| 7 | Chip signature | The issuing state signed this data | The issuing state's private key, or a genuine chip to clone if only the signature is checked |
There is an uncomfortable correlation buried in that table. Checks 1 and 2 are the ones a determined forger clears without effort, and they are also the two that appear most often in marketing copy, precisely because they are the cheapest to build and the easiest to describe in a sentence.
The difficulty curve also has a cliff in it. Checks 3 through 6 get progressively more expensive to beat. Check 7 is not more expensive. It is a different kind of thing.
Authenticate's document forensics runs hologram pattern analysis, font consistency checks, barcode and MRZ validation, UV and IR simulation checks, and template matching against known document designs for the specific ID type. In the terms of the table, that is checks 1, 3 and 4 outright, with simulation-based approaches to 5 and 6. Worth being precise about the difference: a phone camera emits no ultraviolet and filters most infrared, so a remote flow infers those responses rather than measuring them.
Why is the chip the only check a forger cannot fake?
The chip is the only check that requires a secret instead of a skill. Checks 3 through 6 are hard because they demand equipment, materials and reference data, all of which money can buy. Given enough of all three, a well-funded forger clears them. Check 7 asks for something no amount of funding buys on the open market.
ICAO Doc 9303 specifies it across two parts: Part 11 defines the mechanism, and Part 12 defines the public key infrastructure underneath it. A chipped travel document stores a Document Security Object, a signed hash structure covering the data groups on the chip. That object is signed by the issuing country's Document Signer certificate, a copy of which the standard requires to be carried on the chip itself, and which chains to that country's Country Signing Certification Authority, the root of its national public key infrastructure.
Getting hold of those roots is less tidy than it sounds. Document Signer certificates are published to the ICAO Public Key Directory by participating states, but Part 12 makes bilateral exchange between states the primary channel for the root certificates, which reach the directory only when carried on a Master List. Participation is voluntary. So how completely this works depends both on which states publish and on which roots your inspection system already trusts.
To forge a chip's contents you would need to produce a valid signature under a sovereign signing key. Equipment does not help. Skill does not help.
One caveat belongs here, and it is ICAO's own. Verifying the signature proves the data was signed and has not been altered. Part 11 says plainly that it does not prevent an exact copy of the chip's contents, or chip substitution, which is why the standard also defines active authentication and chip authentication to prove the chip itself is genuine. Fabricating chip data needs a sovereign key. Replaying a genuine chip does not.
So why is the entire industry not built on check 7? Two honest constraints.
It requires hardware and cooperation. Reading a chip means near-field communication, which means a capable device held against the document by a user willing to hold it there. Every step of that is a place a real onboarding flow loses people.
And most documents are not chipped travel documents. A US driver's license is not an eMRTD, and the vicinity RFID in some enhanced licenses is not a signed security object either. It has a barcode, printed security features and a state-specific template, and no signed chip to interrogate. For a platform verifying mostly American users, check 7 is unavailable on most of the documents it will ever see, which is exactly why checks 3 through 6 are the load-bearing ones in the US market rather than a consolation prize.
What document verification cannot tell you
Document verification cannot tell you whether the person holding the document is the person it was issued to. That is a different problem with a different answer.
A genuine, unaltered, chip-verified passport tells you the document is real. Presented by someone else, it is a real document and a false identity, and no amount of document forensics will notice. What notices is a biometric match against the document photo, and a liveness check to confirm the face in front of the camera is physically there. Photographs, screens and generated video all fail it. Authenticate's liveness detection is tested to iBeta Level 2 against ISO/IEC 30107-3, and pairing it with the document check is what closes the gap. 400 companies a day are hit by deepfake identity fraud, and none of it is a document problem.
The pairing is the point. Document verification answers "is this real". Liveness and biometric match answer "is this yours". Buying one and assuming you bought both is the most common architectural mistake in this category, and it is invisible until someone exploits it.
How should you evaluate a vendor?
Evaluate a document verification vendor by asking which of the seven checks it actually runs, then by pinning down how each one is implemented. How to evaluate identity verification software covers the general method and the ten questions worth sending any provider. Four are specific to documents.
Which of the seven checks do you run? Ask for the list, mapped to the table above. "Advanced document forensics" is an adjective, not an answer.
Can I see your template coverage for my markets? Check 3 is only as good as the reference library behind it, and coverage varies by country and by document issue year.
Is hologram analysis done on multiple frames or a single still? An optically variable device is defined by how it changes across viewing angles, so a single photograph cannot confirm that a feature actually varies. That takes at least two viewing geometries.
What is your liveness certification, at what level, and on what date? Ask for iBeta Level 2 against ISO/IEC 30107-3, and ask for the date, because presentation attacks improve.
Frequently asked questions
What is document verification?
Document verification confirms that an identity document is genuine, unaltered, and valid. A full document verification stack matches the document against a template for that specific ID type, reads and validates the machine-readable zone, inspects physical security features such as holograms and print technique, and on platforms that read chips, verifies the issuing state's cryptographic signature. Results typically return in seconds.
How does document verification detect a fake ID?
Through layered checks of increasing difficulty: whether the data zones agree with each other, whether the layout matches the issuing authority's template for that document type and year, whether the printing and fonts match the issuer's technique, how holograms behave across viewing angles, how the substrate responds to UV and infrared light, and on chipped documents whether the issuing state's digital signature verifies.
What is the MRZ on an identity document?
The machine-readable zone is the block of monospaced text at the bottom of a passport or ID card. It encodes the document type, issuing country, holder's name, document number, nationality, date of birth, sex and expiry date, plus check digits computed under ICAO Doc 9303 using a repeating 7-3-1 weighting and modulo 10. Those digits detect reading errors. Forgery is outside what they were designed to catch.
Can document verification be fooled?
Yes, and the checks differ enormously in how easily. A check digit is recomputable by anyone who can do arithmetic. Template, print, hologram and UV or IR checks require equipment, materials and reference data, which raises cost sharply. A chip signature requires the issuing state's private key, which is why it is the only check that resists a well-funded forger outright.
How long does document verification take?
A document and selfie check returns a decision in 30 seconds on a modern platform. What extends it is a referral to human review, usually triggered by image quality rather than by a suspected forgery. Ask what triggers a referral: if the answer is image quality, that is a capture problem you can fix, and if it is suspected forgery, ask which of the seven checks raised it.
Is a photo of an ID enough to verify it?
For some checks, yes. For others, no, and this is worth knowing before you design a capture flow. A single still image cannot confirm that a feature is optically variable, because variability is a relationship between two or more viewing angles. Flows that capture short video or multiple frames can inspect security features that a single photograph cannot.
Ask what the check proves
A checksum and a sovereign signature both appear as one line in a feature list. One is arithmetic and the other is cryptography, and the distance between them is the whole product. A forger reads that list too. He is not counting the items. He is looking for the cheapest one you decided to call a fraud check.
Verify your first document free