Document Checks Compared: Visual Features, the Machine-Readable Zone and the NFC Chip
What a visual check, an MRZ check and a chip read each prove about an identity document, with worked decisions for chipless documents, missing certificates, failed reads and mismatched portraits.
A remote flow can look at an identity document in three different ways. It can examine what the camera sees: the photograph, the layout and the printed security features. It can read the two or three lines of machine-readable text at the bottom of the data page and test their internal consistency. And, when the document carries a chip, it can read the chip over NFC and verify the digital signature on its contents. These are different kinds of evidence. They answer different questions, they fail in different ways, and they are not interchangeable.
This article compares them by the question each can answer, and then works through the cases where a method is missing or the methods disagree. It relies on the specifications of the International Civil Aviation Organization (ICAO) for machine readable travel documents, a good-practice report of the European Union Agency for Cybersecurity (ENISA), the guidelines of the European Banking Authority (EBA) on remote customer onboarding, and the technical guideline of the German Federal Office for Information Security (BSI). It does not repeat how the chip protocols work: for that, read how NFC chip verification of passports and ID cards works. For the visual features and how forgeries are made, read reading the security features of an ID document.
The three methods in one paragraph each
Visual inspection
A visual check looks at the photograph of the document, or at a video of it. ENISA describes the detection of visual security elements, such as holograms, watermarks, guilloche prints, UV prints and micro-texts, along with physical properties such as reflections, as usually the first level of defence, especially for documents that carry no electronic security features. It also notes that the application of these features is not consistent across countries and among document types, and that alteration is therefore easier than altering the information in an NFC chip. As a baseline, ENISA says, a minimum set of visual security features is always necessary to verify the authenticity of an identity document remotely.
The machine-readable zone
The machine-readable zone (MRZ) is the block of standardised lines printed in a fixed font at the foot of the data page. The data elements that the chip stores for the zone include check digits for the document number and the dates, and a composite check digit. ENISA lists MRZ verification as a process that validates the integrity of the data encoded in that area of the document, which holds personal information of the holder in a standardised format. The EBA guidelines add that where an institution uses automatic reading such as OCR or MRZ verification, it should take the steps necessary to ensure that the tools capture information in an accurate and consistent manner. They also list, among the points to establish for a reproduction of a document, whether the integrity of the algorithm used to generate the unique identification number of the original document holds in the case of a machine-readable zone.
The chip
An electronic passport or identity card holds a contactless chip. ICAO's specification for the logical data structure makes Data Group 1 mandatory, and defines it as intended to reflect the entire contents of the MRZ. Data Group 2 is the face of the holder, the globally interoperable biometric for machine-assisted identity confirmation. ENISA calls NFC scanning the method considered to provide the highest level of assurance, because the biometric and subject information in the chip can be cryptographically verified through public key infrastructure, and because the photograph in the chip can be used for face matching with a higher accuracy level.
What a chip read must include to count
The word "verified" hides several steps, and ICAO's security specification names them. Under passive authentication, the inspection system reads the document security object, builds and validates a certificate path from a trust anchor to the document signer certificate, uses the verified key to verify the signature of the security object, and hashes the contents of each data group it uses and compares the result with the hash value in the security object. Passive authentication then proves that the contents of the security object and of the data groups are authentic and not changed. Reading the data alone proves none of these things: a chip read without a verified signature, a validated certificate path and matching hashes is an unauthenticated copy of data.
The same specification states two limits. Passive authentication does not prevent an exact copy of the chip content or chip substitution, and the specification says it should be supported by an additional physical inspection of the document. It also expects the inspection system to hold what the check needs: for each issuing State, the country signing certificate or the relevant information extracted from it must be securely stored, and the inspection system must have access to verified revocation information. A remote verifier therefore holds, and keeps current, the certificates of the countries whose documents it accepts. ICAO's public key directory describes itself as a central repository for the information needed to authenticate electronic machine readable travel documents, and says that if the chip is not authenticated, the electronic passport has little advantage over a traditional, non-electronic passport.
Copy protection is a separate, optional layer. The security specification lists active authentication and chip authentication as advanced methods, optional or conditional for the issuing State, and says they address copying and substitution of the chip. It lists a comparison of the conventional MRZ with the MRZ held in the chip as an advanced method that proves the chip's content and the physical document belong together. Whether a particular document supports copy protection is a fact about that document, and a result should record it.
Reading the chip needs the printed data
ICAO requires issuing States to implement an access control mechanism for the chip, so that the contents cannot be read without the bearer knowing the data is being read. The inspection system proves knowledge of information derived from the physical document, for example from the MRZ. The specification says the information has to be retrieved optically or visually from the document, and that it must be possible for an inspector to enter it manually if machine reading fails. For the newer protocol it adds a number printed on the document that, in its words, can easily be typed in manually. BSI's technical guideline describes the password-authenticated protocol that replaces the older basic access control: it is based on a shared password, such as a PIN known only to the holder or a card access number printed on the document.
This shapes a remote flow in a way that is easy to get wrong. A failed optical read of the zone does not by itself lock the chip: the same values can be typed. What the failed read removes is a cross-check, because the camera can no longer confirm that the typed values match the printed page. The worked decisions below use this distinction.
The questions each method can answer
The table combines what the sources say with our own reading of them. A blank cell means the method does not address the question. "Chip, signature verified" means all the steps in the section above were run and passed.
| Question | Visual inspection | MRZ check | Chip, signature verified | Chip, signature verified, with copy protection and a matching MRZ |
|---|---|---|---|---|
| Does the document look like a valid specimen of its type? | Yes, by features and layout | |||
| Was the printed data page altered after issue? | Partly | Inconsistency shows; a forger who recomputes the check digits is not caught | Only by comparing the page with the signed chip data | Same, and the matched MRZ covers the zone lines |
| Was the data in the chip altered after issue? | Yes: the issuer's signature and the data group hashes cover it | Yes | ||
| Was the printed portrait replaced? | Partly | No | Only by comparing it with the signed face image in the chip | Same |
| Is the data internally consistent? | Only the check digits: arithmetic, not factual correctness | Requires separate consistency checks | Requires separate consistency checks | |
| Is this chip a copy of another chip? | No | Yes | ||
| Does the chip belong to this physical document? | Only if the MRZ comparison is also run | Yes | ||
| Is the person presenting the holder? | By comparing the face | No | By comparing the selfie with the signed face image | By comparing the selfie with the signed face image |
Two rows deserve a comment. The signature covers the chip's contents, not the printed page, so a chip cannot say that the printed portrait is the original; the printed page and the chip have to be compared with each other. This is the reason the specification asks for an additional physical inspection to support passive authentication.
Worked decisions
The cases below are our reasoning from the sources above, not requirements in any of them. Each gives what is in hand, what it proves, a decision a flow could take, and what to log.
A document with no chip
In hand: the printed page, the MRZ and the visual features. What it proves: that the page looks like a specimen and that the zone is internally consistent. It does not prove that the data are unaltered if the forger recomputed the check digits, and the visual features are applied unevenly across countries and document types. Decision: accept only within the risk limits set for print-only evidence, add the document anti-fraud checks, the liveness step and the face match, and send higher-risk cases to a person. Log: method print and MRZ, no chip.
A chip that reads but whose signature cannot be verified
In hand: chip data, and no certificate path from a trust anchor to the document signer certificate, because the country's certificates are not held or the check failed. What it proves: nothing about authenticity, since without the verified signature the data are an unauthenticated copy. Decision: treat the document as a chipless one for the authenticity question, compare the chip data with the print as a consistency check, and send disagreement to a person. Log: chip read, signature not verified, with the reason. Do not report this as "chip verified".
A chip that cannot be read
In hand: the printed page; the phone has no NFC, the chip does not answer, or the user cannot position the document. Decision, in order: retry; offer the typed route with the card access number or the zone values if the document supports it; offer another document that can be read; then treat the case as a chipless one. The EBA guidelines say that where evidence is of insufficient quality the process should be interrupted and restarted or redirected to face-to-face verification, so a last step to a person or a branch should exist. Log: reason for the failure and the path taken.
An optical read that fails while the chip works
In hand: the user types the document values and the chip opens. What it proves: that the user knows the printed data, which is the access condition ICAO sets. What it does not give: the cross-check that the camera saw the same values on the page. Decision: ask for a clearer capture of the page for the visual checks, and if that is not possible send the case to a person. Log: access by typed values.
A signed face that does not match the printed portrait
In hand: a verified signature, a chip face image and a printed portrait that differ. What it proves: the chip image is the issuer's data. The printed page is then wrong, or the chip belongs to another document, and a passing selfie against the chip image does not repair that. Decision: stop automatic acceptance in all variants, and send to a person or reject by policy. Log: both comparison results and the images used.
A verified chip on a document without copy protection
In hand: a verified signature, a chip image that matches the selfie, and a document that does not support active or chip authentication. What it proves: that the data are the issuer's and unchanged. It does not exclude a cloned chip placed in a forged document, because passive authentication does not prevent exact copying. Decision: compare the printed page and the zone with the chip data, require the liveness step, and apply a lower limit than for a document with copy protection. Log: copy protection not supported by this document.
One field that differs between print and chip
In hand: a verified signature and a name or place spelled differently on the page and in the chip. Decision: first check whether the difference is a formatting or transliteration rule, and if no rule explains it, treat the printed page as altered and send to a person. Log: the field, both values and the rule applied.
What the regulators say
The EBA guidelines treat the chip as one available source. Where the device the customer uses allows the collection of relevant data, for example because the data is contained in the chip of a national identity card, and it is technically feasible for the institution to access it, the institution should consider using that information to verify consistency with information obtained from other sources. The wording is "should consider", not "must". For the visual side, the guidelines say that where available the institution should verify the security features embedded in the official document, such as holograms, as proof of authenticity. For reproductions, they list a check on whether the personal data were altered or the photograph replaced, a check against official specimen databases such as PRADO, and a check that the reproduction was not displayed on a screen from a photograph or scan of the original.
ENISA adds a legal caution. In March 2024 it wrote that although it is technically possible, scanning the chip of an official identification document to retrieve and verify the holder's information and photograph is not consistently permitted across the European Union, and that this could give attackers an opportunity to target Member States where chip reading by private providers is not legally permitted. It named Switzerland as an exception where the financial supervisor allows chip scanning in online identity proofing. The legal position moves, so check the current national rules before designing a flow that depends on the chip. ENISA also says that even though chip reading is considered to provide the highest level of assurance, the level achieved always depends on the security of the chip and its data.
Failure modes compared
| Failure | Visual | MRZ | Chip |
|---|---|---|---|
| Poor lighting, glare, a damaged laminate | Common, reduces confidence | Misreads characters | Does not apply, but the optical read that unlocks the chip may fail; the values can be typed instead, without the cross-check |
| A document with no chip | Works | Works | Not available |
| A chip from a country whose certificates the verifier lacks | Works | Works | Signature cannot be verified |
| A convincing printed forgery | The reason the method exists | May pass if the forger computes the check digits | The forged print fails to match the signed data |
| A cloned chip with a forged printed page | May pass | May pass | Depends on whether copy protection is supported and checked |
| A phone without NFC, or a user who cannot position the document | Works | Works | Not available; needs a fallback |
The table reflects our reading of the sources, not a measurement. Read the failure rates of any real product from its own evidence.
How to combine them
A defensible remote flow treats the methods as layers.
- Capture first, with a typed fallback. Read the MRZ and the visual features, and reject captures that are too poor to read. The same values open the chip, and the specification requires that an inspector can enter them manually, but a typed route removes the cross-check and should be logged as such.
- Compare across methods. Check that the MRZ, the printed data page and, where available, the chip's Data Group 1 agree. A forgery that satisfies one method may not satisfy the others.
- Use the chip where it is available and lawful. Run the full passive authentication sequence, compare the signed face with the selfie and with the printed portrait, and record which copy-protection checks the document supported and ran.
- Plan the fallback. Decide in advance what a user does when the document has no chip, the phone has no NFC, or the certificate is not available, using the worked decisions above. The EBA guidelines say that where evidence is of insufficient quality the process should be interrupted and restarted or redirected to face-to-face verification.
- Log the method used. A later audit needs to know whether a decision rested on a print, on an MRZ or on a signed chip.
Questions to ask a provider
- Which of the three methods does the flow run, and in which order?
- For chip reads, is the full passive authentication sequence run, including the certificate path and the data group hashes, and which of active authentication and chip authentication are run?
- What is recorded when a document does not support copy protection, and when the signature could not be verified?
- How are the signing certificates of issuing countries obtained and kept current, and how is revocation information obtained?
- What does the flow do if the chip cannot be read, and is that path visible in the result?
- Which countries' documents are read by chip today, and is that list stated in the contract?
Where this sits in a verification flow
A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, including printed and handwritten text and the machine readable zone with its checksum. Document anti-fraud checks, covering screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors, are included in every package. NeuroVision reads the NFC chip of identity documents. The data comes from the chip, not from a photo of the document. This article does not list the chip protocols, documents or countries that NeuroVision supports.
To go through your documents and markets, contact the team.
Sources
All sources were fetched on 27 October 2026.
- Remote ID Proofing Good Practices, European Union Agency for Cybersecurity (ENISA), March 2024.
- Guidelines on the use of Remote Customer Onboarding Solutions, European Banking Authority.
- Doc 9303 Part 10, Logical Data Structure for Storage of Biometrics and Other Data in the Contactless Integrated Circuit, International Civil Aviation Organization.
- Doc 9303 Part 11, Security Mechanisms for MRTDs, Sections 4, 5 and 8, International Civil Aviation Organization.
- Doc 9303 Part 12, Public Key Infrastructure for MRTDs, International Civil Aviation Organization.
- ICAO PKD, International Civil Aviation Organization.
- BSI Technical Guideline TR-03110, Federal Office for Information Security (BSI).