Automated Document Validation: Error Rates and the MRZ Check

An automated document check says "valid" or "invalid" about an ID photographed by an applicant. As a developer integrating it, or as a fraud analyst living with its mistakes, you need to know how such a check can be measured and what a sensible acceptance test looks like. This article answers one question: what does the US identity proofing guideline require of automated document validation, how are its two error rates defined, and what does a machine readable zone check add?

Where validation sits

In the three-step process of Special Publication 800-63A-4, validation is the second step, after the provider has collected the identity evidence and before it verifies that the applicant is the owner. Its goal is to determine that the collected evidence is genuine and valid. The publication describes evidence validation as examining the presented evidence to confirm that it is authentic, meaning not forged or altered, accurate, and valid, meaning unexpired or within the provider's defined timeframe.

The provider has to confirm four things about presented evidence: that it is in the correct format and includes complete information for its type, that it does not show signs of being counterfeit or tampered with, that it contains physical or digital security features, and that the core attributes and data fields needed to determine authenticity are accurate. The acceptable methods are visual and tactile inspection by trained personnel on site, visual inspection by trained personnel for remote proofing, automated document validation using appropriate technologies, and cryptographic verification of digital evidence.

The two error rates

For automated validation of physical documents, the publication sets two performance measures and defines them in footnotes.

• The document false acceptance rate, DFAR, is the proportion of processed fraudulent documents that the validation system determined to be valid, divided by the number of processed fraudulent documents. The requirement is 0.1 or less.
• The document false rejection rate, DFRR, is the proportion of processed genuine documents that the validation system determined to be invalid, divided by the number of processed genuine documents. The requirement is also 0.1 or less.

The two definitions have different denominators, which is the first thing to notice. DFAR is measured on a set of fraudulent documents and DFRR on a set of genuine ones. A test that uses only genuine documents can say nothing about DFAR, and a test that uses only forgeries can say nothing about DFRR. When a vendor quotes one rate, ask for the other and for the composition of both test sets.

The second thing to notice is the trade-off. A stricter check reduces false acceptance and increases false rejection of real customers, and the guideline's requirement of two rates, not one, keeps either from being traded away silently.

The machine readable zone

If a machine readable zone or a barcode is present on the evidence, the publication requires the optical capture and inspection to compare the machine readable data with the printed data on the evidence for consistency. This is a cheap and strong signal: a forger who alters the printed date of birth has to alter the zone as well, and the two have to agree.

The UK Home Office National Document Fraud Unit makes a complementary point in its guidance for people who examine documents by eye. Most passports and identity cards have a standardised machine readable zone, and only the characters of a defined font should be seen in its lines; characters that do not match the font exactly could indicate a counterfeit or forgery. The same guidance adds a nuance that automated systems must respect: some countries have issued genuine passports with a non-compliant font in the zone. Its checklist suggests using an online MRZ checker if available.

In practice this means an MRZ result is a signal that feeds a decision, not a verdict on its own. A mismatch is a strong reason to look closer. A font irregularity alone has to be weighed against the issuing country and document type.

Live capture and document presence

The publication also requires the provider to implement live capture of documents during validation and, in the publication's terms, passive or active document presence checks, also called document liveness. These confirm that the document is physically present and that the image captured during the session is not a manipulated digital copy. For the prevention of injected modified media it points to the separate controls for injection prevention and forged media detection.

For a developer, the consequence is concrete. A flow that accepts an uploaded file from the gallery gives up the live-capture property. A flow that captures through the camera in the session keeps it.

Test it where it will run

The publication asks providers to assess the performance of their optical capture and inspection technology in conditions that are substantially similar to the operational environment and to the types of evidence the user base presents, accounting for every evidence type allowed. If subscribers' documents, personal information or images are used in testing, it has to be on a voluntary basis with notification and consent. Providers should have the validation technology periodically tested by independent entities such as laboratories or research institutions, and must make the results of their testing publicly available. These requirements apply to technologies that capture and validate images of physical identity evidence and not to validation techniques that rely on cryptography embedded in the evidence itself.

Where a trained agent inspects evidence remotely, the publication asks for devices and connections that support sufficiently high-quality imagery, and recommends supporting the visual validation with automated document validation. It also states that, because of the number of evidence types, it does not attempt to give a comprehensive list of security features; providers need validation training specific to the evidence types they accept.

An acceptance test you can run

1. Build two sets: genuine documents from the types and countries you expect, and fraudulent or altered documents from the classes you fear (photocopies, printouts, screen photos, edited images, substituted photographs).
2. Run both through the check and compute DFAR on the second set and DFRR on the first, exactly as defined above.
3. Slice the results by document type, country and capture device, because averages hide weak spots.
4. Add cases where the zone and the printed data disagree, and cases of genuine documents with irregular fonts, and record how the decision engine treats them.
5. Repeat after every model or rule change, and keep the results.

How NeuroVision fits

The document step of a NeuroVision verification session detects, classifies and reads IDs. It reads printed and handwritten text and the machine readable zone with its checksum, and it carries signature and stamp checks. Document anti-fraud covers screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors, and it is included in every package. Document types accepted include passport, national ID, driver's licence, residence permit, visa and proof of address.

To discuss an acceptance test on your own document mix, contact the team.

Sources

All sources were fetched on 27 October 2026.

• Digital Identity Guidelines, Special Publication 800-63A-4, Identity Proofing and Enrollment, US National Institute of Standards and Technology.
• Guidance on examining identity documents, National Document Fraud Unit, Home Office, United Kingdom.