Passport and ID Document Verification: Complete Guide

Passport verification is the foundation of identity assurance for any organisation that must confirm who it is dealing with. In the UK alone, HM Passport Office issued 7.1 million passports in 2024, while the Home Office processed over 1.2 million Biometric Residence Permits. For regulated businesses subject to Money Laundering Regulations 2017, the ability to authenticate these documents accurately and at speed determines whether onboarding is secure or merely fast.

This guide covers the security features embedded in modern identity documents, the verification methods available, the ICAO standards that underpin machine-readable travel documents, UK-specific document types and checks, and the fraud techniques most commonly encountered in practice.

Security features of modern identity documents

Modern passports and identity documents rely on multiple overlapping security layers. Each layer targets a different verification method -- visual inspection, optical analysis, or electronic reading -- so that defeating one layer does not compromise the entire document.

Machine Readable Zone (MRZ)

The MRZ is a block of structured text at the bottom of the document's data page, readable by optical scanners. On a UK passport, it consists of two lines of 44 characters encoding the document type, issuing state (GBR), surname, given names, passport number, nationality, date of birth, sex, expiry date, and personal number. Each data field is followed by a check digit calculated using a modular arithmetic algorithm defined in ICAO Doc 9303.

Biometric Residence Permits (BRPs) use the TD1 format: three lines of 30 characters. UK driving licences issued by the DVLA do not contain a standard MRZ, though the document number encodes date of birth and name data in a structured format.

RFID / NFC chip

UK biometric passports (issued since 2006) contain an RFID chip storing a digitised facial photograph, the MRZ data, and (since 2010) two fingerprint images. The chip is protected by Basic Access Control (BAC), which uses data printed on the data page as the access key, and Extended Access Control (EAC) for biometric data, restricted to authorised government agencies.

BRPs also contain an NFC chip with facial and fingerprint biometrics protected by the same protocols.

Visual and optical security features

Watermark and intaglio printing

UK passports contain a multi-tone watermark visible by transmitted light, incorporating the Royal Coat of Arms. The data page uses intaglio printing (raised ink detectable by touch), a feature that cannot be replicated by standard inkjet or laser printers.

Verification methods: manual versus automated

The choice between manual and automated verification depends on document volume, acceptable risk levels, and regulatory requirements. The UK's Digital Identity and Attributes Trust Framework (DIATF), published by the Department for Science, Innovation and Technology, sets the benchmark for identity verification standards across sectors.

Comparison of verification methods

Manual verification

Manual verification remains common in solicitors' offices, estate agencies, and smaller financial institutions. It relies on visual inspection of holograms, watermarks, and microprinting, combined with comparing the photograph to the document holder. Agents may consult the Home Office online right to work checking service to confirm immigration status, though this does not authenticate the document itself.

The DIATF framework defines four levels of confidence for identity verification. Manual checks typically achieve "Medium" confidence at best, which is insufficient for high-risk onboarding scenarios such as financing and leasing or regulated financial services.

Automated verification

Automated verification combines OCR, image analysis, NFC chip reading, and algorithmic MRZ validation. Solutions like CheckFile process a document in under 10 seconds: reading and validating the MRZ (including all check digits), detecting visual security features, extracting file metadata, and performing facial comparison against a live selfie.

For organisations processing high volumes, automated verification is the only practical approach. Refer to our industry verification guide for sector-specific implementation guidance.

ICAO standards and machine-readable zones

The International Civil Aviation Organization (ICAO) defines the standards for machine-readable travel documents in the ICAO Doc 9303 series, applicable across all 193 ICAO member states.

Structure of Doc 9303

Doc 9303 comprises 13 parts covering the full lifecycle of machine-readable travel documents:

• Part 1: Introduction and terminology
• Part 3: Common specifications for machine-readable travel documents (MRTDs) -- TD1 (card), TD2 (small format), and TD3 (passport) formats
• Part 4: Specifications for machine-readable passports (MRP)
• Part 9: Deployment of biometric identification
• Part 11: Security mechanisms for MRTDs
• Part 13: Visible digital seal (VDS) specifications

MRZ format for passports (TD3)

The TD3 format uses two lines of 44 characters. Line 1 contains the document type (P), the issuing state code (GBR for UK), surname, and given names. Line 2 contains the passport number, nationality, date of birth, sex, expiry date, optional data, and check digits. Each data block is followed by a check digit calculated using the algorithm defined in Part 4 of Doc 9303.

MRZ format for BRPs and ID cards (TD1)

BRPs use the TD1 format: three lines of 30 characters. Line 1 contains the document type, issuing state, and document number with check digit. Line 2 contains date of birth, sex, expiry date, nationality, and optional data. Line 3 contains the holder's name. A composite check digit on line 2 validates the entire data set.

ICAO compliance ensures interoperability across all member states, which is critical for businesses operating internationally. The eIDAS 2.0 regulation and EU Digital Identity Wallet will complement this framework by introducing a European digital identity wallet by 2027, with implications for UK-based firms serving EU customers.

UK-specific identity documents: types and verification points

The UK issues several identity document types, each with distinct security features and verification requirements. Unlike many EU countries, the UK does not have a national identity card, making the passport the primary government-issued identity document for British citizens.

UK passport

The current UK passport (issued since 2020) features a navy blue cover and contains a polycarbonate data page with laser-engraved personalisation. Key verification points:

• RFID chip with BAC and EAC protection
• Kinegram hologram (Royal Coat of Arms)
• Laser-perforated personalisation on data page
• UV-reactive security features on multiple pages
• MRZ TD3 format (two lines, 44 characters)

HM Passport Office's guidance on passport security features provides reference material for verification agents.

Biometric Residence Permit (BRP)

BRPs are credit-card-sized polycarbonate documents issued to non-EEA nationals with permission to stay in the UK. They contain an NFC chip with biometric data, a laser-engraved photograph, and a TD1 MRZ. BRPs are being phased out from 2025, replaced by eVisas linked to the holder's passport, but existing BRPs remain valid until their expiry date.

DVLA driving licence

The UK photocard driving licence issued by the DVLA is widely used as a secondary identity document. While it does not contain an MRZ or RFID chip, it includes several security features: UV-reactive elements, microprinting, a tactile surface, and a holographic overlay. The driver number encodes the holder's surname and date of birth in a structured format that can be cross-validated.

Document verification reference table

Common fraud techniques and detection methods

Identity document fraud in the UK falls into four main categories, each requiring different detection approaches. The National Crime Agency reported that identity fraud facilitated an estimated GBP 1.8 billion in criminal activity in 2024.

Complete counterfeits

The fraudster produces an entirely fabricated document. Low-quality counterfeits are detectable through the absence of functional holograms, typographic errors, and missing watermarks. High-quality industrial counterfeits require analysis of microprinting, substrate composition, and NFC chip verification (absent or non-compliant on counterfeits).

Complete counterfeits represent approximately 20% of document fraud detected in the UK, according to the National Document Fraud Unit (NDFU).

Alteration of genuine documents

The fraudster modifies an authentic document: replacing the photograph, changing dates or names, or erasing and reprinting data. Detection relies on:

• Analysis of laminate integrity (lifted or resealed laminate visible under oblique light)
• Consistency between printed data and MRZ-encoded data
• Comparison of MRZ data with NFC chip data (any discrepancy indicates tampering)

Impersonation (genuine document, wrong holder)

The fraudster uses a genuine document belonging to another person of similar appearance. This is the most difficult fraud type to detect through document verification alone. Countermeasures combine:

• Facial comparison between the holder and the document photograph (facial biometrics)
• Biometric data verification from the NFC chip (where reader is available)
• Liveness detection to exclude screen presentations and deepfakes

Stolen or lost documents

Documents reported stolen or lost are sometimes reused by third parties. The Home Office's online checking services provide status verification for BRPs and visas, but there is no public-facing UK passport invalidation database comparable to France's DocVerif. Automated systems should flag documents with expiry dates that do not match the holder's apparent age or application context.

Fraud detection matrix

Frequently asked questions

Is passport verification legally required for UK businesses?

Yes, for firms subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). This includes banks, building societies, estate agents, solicitors, accountants, and high-value dealers. Regulation 28 requires customer due diligence including verification of the customer's identity on the basis of documents or information obtained from a reliable and independent source.

What is the DIATF and how does it affect document verification?

The Digital Identity and Attributes Trust Framework, published by the Department for Science, Innovation and Technology, sets standards for organisations providing digital identity services in the UK. Certified identity service providers must meet defined levels of confidence for identity verification. The framework is not mandatory for all businesses, but compliance is increasingly expected by regulators and sector bodies.

Can automated verification read all types of UK identity documents?

Automated systems can read and validate MRZ data on passports and BRPs, and read NFC chip data on biometric documents. For DVLA driving licences (which lack MRZ and NFC), verification relies on image analysis, security feature detection, and cross-validation of the structured driver number. Solutions like CheckFile support all major UK document types plus over 6,000 document types from 200 countries.

How should businesses handle expired documents?

Expired passports and BRPs should not be accepted as primary identity evidence under MLR 2017. However, an expired passport may serve as supporting evidence in combination with a current document. The DIATF specifies that expired documents may be acceptable for identity proofing if the chip data is still readable and the document has not been cancelled. Each business should define its policy based on its risk appetite and regulatory requirements.

Is automated document verification GDPR-compliant?

Yes, provided the processing complies with UK GDPR principles: data minimisation, purpose limitation, and storage limitation. Processing biometric data (facial comparison) falls under Article 9 of UK GDPR and requires explicit consent or a specific legal basis. Review our security page for details of our compliance architecture.

Moving to automated passport and ID verification

Manual identity document checks cannot keep pace with the volume and sophistication of modern document fraud. Automated verification combines MRZ reading, image analysis, NFC chip authentication, and facial biometrics to achieve detection rates above 95%, with processing times under 10 seconds per document.

CheckFile supports businesses across all regulated sectors in deploying automated document verification. Whether you operate in financing and leasing, banking, insurance, or property, our platform integrates with existing workflows via REST API. Review our pricing or contact our team to arrange a demonstration using your own document types and workflows.