Introduction
The MRZ (Machine Readable Zone) of an identity document contains several security mechanisms designed to ensure the integrity of the information it contains. Among these mechanisms, MRZ check digits, also called control digits or check digits, play a central role.
These digits allow automatic verification that the document data has not been altered and has been correctly read or entered. They are used by border control systems, banks, employers, and digital platforms as part of identity verification procedures.
Understanding how MRZ check digits work makes it possible not only to verify the authenticity of a document but also to detect many inconsistencies that may reveal errors or falsifications.
What is an MRZ check digit?
An MRZ check digit is a number calculated from a sequence of characters present in the MRZ. This number is obtained by applying an algorithm defined by the international ICAO 9303 standard, which standardizes machine-readable identity documents worldwide.
Each check digit is associated with a specific MRZ field, such as the document number, date of birth, or expiration date. It allows verification that the corresponding character string is valid and has not been modified.
The principle is simple: if even a single character in the field is modified, intentionally or not, the recalculated check digit will no longer match the one present in the MRZ. This inconsistency is a warning signal indicating that the document may contain an error or may have been falsified.
Check digits are integrated directly into the MRZ and can be verified automatically by software, without human intervention.
Which MRZ fields contain a check digit?
In most identity documents compliant with the ICAO 9303 standard, several fields are protected by an independent check digit. This includes the document number, which uniquely identifies the document, as well as the date of birth and expiration date.
Some documents also contain a check digit associated with the holder’s personal number, when such a number is present. Finally, a global check digit allows verification of the integrity of a combination of fields, providing an additional level of security.
This structure makes it possible to precisely identify which information is incorrect or inconsistent, helping detect reading errors or modification attempts.
MRZ check digit calculation principle
The calculation of an MRZ check digit is based on a simple but effective algorithm that converts characters into numerical values and applies a series of weighting factors.
Each character in the string to verify is first converted into a number. Digits retain their natural value, while letters are converted according to their position in the alphabet, where A equals 10, B equals 11, and so on up to Z, which equals 35. The filler character “<”, frequently used in MRZ, corresponds to the value 0.
Once this conversion is performed, each value is multiplied by a coefficient. These coefficients follow a fixed sequence defined by the ICAO 9303 standard: 7, then 3, then 1. This sequence repeats for each character in the string, regardless of its length.
The results are then added together to produce a total sum. The check digit corresponds to the last digit of this sum, that is, the result of modulo 10. This digit, between 0 and 9, is the one displayed in the MRZ.
This mechanism effectively detects any modification, since even a minor change in the original string produces a different result.
Example of check digit calculation
Let’s take the example of a date of birth appearing in an MRZ: 880504, corresponding to May 4, 1988.
Each digit is used directly, since they are purely numeric characters. The first digit, 8, is multiplied by 7, which gives 56. The second digit, also 8, is multiplied by 3, which gives 24. The third digit, 0, is multiplied by 1, which gives 0.
The weighting sequence then repeats. The digit 5 is multiplied by 7, giving 35. The digit 0 is multiplied by 3, giving 0. Finally, the digit 4 is multiplied by 1, giving 4.
The sum of all these results is 56 + 24 + 0 + 35 + 0 + 4, which equals 119. The last digit of this result is 9. The check digit associated with this date of birth is therefore 9.
If the MRZ actually contains this digit in the expected position, the date of birth is considered valid. Otherwise, an inconsistency is detected.
Individuals, do you occasionally need to verify one or more identity documents ?
Professionals, do you need to integrate proof of identity validation into one of your business processes, including all European identity cards and global passports ?
Where are check digits located on a passport?
On a passport, check digits are located on the second line. They apply to:
- the passport number
- the holder’s date of birth
- the document expiration date
- country-specific data (not present in this example, with the check digit located just before the global check digit)
- all data present in the passport (the global check digit)
Where are check digits located on an identity card?
On an identity card, check digits are located on the first and second lines. They apply to:
- the identity card number
- the holder’s date of birth
- the document expiration date
- all data present in the identity document (the global check digit)
Example with a complete MRZ
Consider a simplified MRZ containing a document number, a date of birth, and an expiration date. Each of these fields has its own check digit.
By recalculating the check digits from the values present, it is possible to verify that all information is consistent. If even one check digit does not match, it indicates that the associated field contains an error or has been modified.
This verification can be performed manually, but it is most often carried out automatically by software, allowing fast and reliable validation.
Why are MRZ check digits effective against fraud?
Check digits are a particularly effective security mechanism for detecting errors and alterations. They allow instant verification of the internal consistency of the MRZ without requiring access to an external database.
When a fraudster modifies a visible field of the document, such as the date of birth or document number, they must also correctly recalculate the corresponding check digit. Any error in this recalculation makes the falsification detectable.
Even in the case of an automatic reading error, for example during optical character recognition, the check digit immediately reveals that the extracted data is incorrect.
This mechanism therefore plays a key role in the reliability of automated identity verification systems.
Limitations of MRZ check digits
Although very useful, MRZ check digits alone cannot guarantee the authenticity of a document. They only verify the mathematical consistency of the data present in the MRZ, not the origin of the document itself.
An experienced fraudster with the necessary technical knowledge can correctly recalculate check digits after modifying certain information. In this case, the MRZ remains mathematically valid even if the document has been falsified.
For this reason, check digit verification must always be combined with other checks, such as visual inspection of the document, verification of security features, and comparison with visible information.
Automatic verification of MRZ check digits
In practice, check digits are verified automatically by specialized software capable of reading the MRZ and instantly recalculating the check digits.
This automation allows inconsistencies to be detected quickly, without human error, and represents an essential step in modern identity verification procedures.
Automated systems used by authorities, financial institutions, and online services rely on this mechanism to ensure the reliability of extracted identity document data.
Conclusion
MRZ check digits are a fundamental element of the security system of machine-readable identity documents. Their operation is based on a simple but robust algorithm capable of effectively detecting errors and alterations.
They allow fast verification of the consistency of information contained in the MRZ and play a central role in automated verification processes.
However, their effectiveness depends on their use alongside other verification methods to ensure complete validation of document authenticity.
Individuals, do you occasionally need to verify one or more identity documents ?
Professionals, do you need to integrate proof of identity validation into one of your business processes, including all European identity cards and global passports ?
