How to Verify a QR Code or Barcode on Official Documents in Australia

Verifying a QR code or barcode on an official document means checking not just that it scans, but what it actually proves: a cryptographic signature tied to the issuer, or merely a convenience encoding of printed text. A scannable code is not automatic evidence of authenticity — France's 2D-Doc and several Australian state digital driver licence apps are cryptographically signed, while most plastic driver licence barcodes and magnetic stripes simply repeat visible data and can be regenerated with the right software. This guide explains how to tell the difference.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.

---

What Does a QR Code or Barcode on a Document Actually Prove

A QR code or barcode proves only what its payload contains — nothing more. Two documents can look identical at a glance, yet one may carry a code that cryptographically signs the printed content while the other merely stores a copy of the same text; a scanning app opens both regardless. The question that matters is not whether the code scans, but what data model sits behind it.

Three models exist in practice: a plain data carrier stores a copy of printed fields with no cryptographic link to an issuer; a verification-URL carrier points to a web page that checks the document against a live database; a cryptographically signed carrier contains a digital signature, generated with the issuer's private key, verifiable offline against a public key. France's 2D-Doc standard, specified by ANTS in its cahier des charges v3.3.4 of 17 June 2024, is the clearest large-scale example of the signed model, used on over 50 official French document types since income tax notices adopted it in April 2022 (ANTS 2D-Doc specification).

Is a Scannable QR Code Proof That a Document Is Genuine

A scannable QR code is not proof of genuineness, because a fraudster can encode whatever payload they choose and print or display it on a forged document. What matters is whether the decoded content can be checked against a source the fraudster does not control. Users on Australian identity-verification and hospitality forums often ask a version of this question directly — whether a digital licence QR code "actually proves the ID is real, or whether a screenshot or screen-recorded loop of the app would scan the same way." It depends entirely on the format.

A code built on a plain data-carrier model, like the barcode or magnetic stripe on most Australian plastic state and territory driver licences, only demonstrates internal consistency, not authenticity. Australia has not standardised on the AAMVA PDF417 format used on North American licences; most physical cards instead carry a simpler 1D barcode or magnetic stripe encoding the name, date of birth, licence number, and state or territory code already printed on the card, with no cryptographic link to the issuer. A verifier scanning it cross-checks OCR'd printed text against barcode text; if a forger edits both consistently, the barcode "matches" a document that is entirely fake.

How Does France's 2D-Doc Standard Prove Document Authenticity

France's 2D-Doc proves authenticity because its Datamatrix code embeds an asymmetric cryptographic signature computed by the issuing authority, not merely a copy of the printed fields. The 2D-Doc cahier des charges (v3.3.4, published 17 June 2024 by France Titres) defines a signed payload structure covering identity documents, tax notices, and utility bills, verifiable offline by any reader holding the relevant public key certificate (ANTS technical specification, PDF). A verifier decodes the Datamatrix and confirms mathematically that the signed data has not changed since it was signed.

A French avis d'imposition, mandatory since April 2022, cannot be forged by editing the visible numbers alone, because the signature would no longer validate. For an Australian verifier handling French documents in a KYC flow, only signature verification against the correct public key confirms the document is genuine.

What Is the MRZ and How Does It Detect Forged Passports

The Machine Readable Zone (MRZ) is the two-line OCR-B text block at the base of a passport or ID card photo page, structured under ICAO Doc 9303 — the standard the Australian Passport Office applies — so every field carries an algorithmically computed check digit. If a fraudster alters a date of birth, document number, or expiry date without correctly recalculating the check digit, the mismatch is detectable by any reader running the ICAO algorithm, offline.

A mismatch between printed visual data and MRZ-derived data, or between the MRZ and its own check digits, is an automatically detectable forgery signal defined by ICAO 9303. The MRZ is not a barcode, but its self-checking arithmetic gives it built-in consistency verification plain barcodes lack. See our guide to fake passport fraud detection for more.

Comparing QR and Barcode Verification Standards

No two code standards prove the same thing, and mixing up their guarantees is a common verification mistake.

Under eIDAS 2, all 27 EU member states must offer citizens a digital identity wallet by December 2026, with financial institutions expected to accept wallet credentials within 36 months of the implementing acts entering into force. Its QR codes enable cross-device authentication, but the trust anchor is the credential, not the image — a model Australia is only starting to build federally, though several states already run it.

What Is Australia's Equivalent to a Signed Document QR Code

Australia does not yet have a single nationwide signed document standard comparable to 2D-Doc, but the building blocks are in place. The Digital ID Act 2024 (Cth) commenced on 30 November 2024, establishing AGDIS and appointing the ACCC as Digital ID Regulator, co-regulating with the OAIC under the Privacy Act 1988 and the Australian Privacy Principles (Digital ID System: Digital ID Act 2024). myID — renamed from myGovID in November 2024 and run by the ATO — remains the main Digital ID service for myGov, Medicare, and Centrelink, with accredited private-sector providers able to join AGDIS from 30 November 2026 (ATO: myGovID is now called myID).

The more mature signed-code example sits at state level. NSW and Queensland both run digital driver licence apps — Service NSW and Queensland's Thales-built Digital Licence — that generate a fresh cryptographic signature each time the QR code is presented, checked live against the issuing agency rather than merely decoded. Modifying the data returns a certificate signature mismatch when scanned through the state's checker tool — the same trust model as 2D-Doc, verifiable by anyone running the official reader rather than anyone with a camera (Service NSW: licence checkers). The plastic card in the same wallet still carries only a plain barcode or magnetic stripe, so which document a business asks for changes what the scan proves. More than 10,000 people reported myGov or linked-account misuse to IDCARE in the year to early 2026, almost double 2023 (IDCARE) — reason enough to keep cross-checking beyond the code until AGDIS reaches further into the private sector. Our guide to government ID verification and digital identity programs covers how these schemes fit together nationally.

Can Someone Fake a QR Code on a Payslip or Bank Document

Yes — a QR code on a payslip or bank document can be faked whenever it is a plain data carrier or points to a website the fraudster also controls. A convincing forgery only needs a QR image with plausible text or a lookalike domain, neither requiring specialist skill. This is also why quishing — a fraudulent sticker placed over a legitimate code — is a recognised fraud pattern on parking meters and posted mail in Australia, flagged by the ACCC's Scamwatch as related to, but distinct from, document forgery.

Only a verification flow that checks whether the destination domain matches the genuine issuer, whether the payload format matches known genuine samples, and whether the surrounding document is internally consistent gives a defensible answer.

How to Manually Check a QR Code or Barcode for Signs of Forgery

Inspect the code's physical placement before scanning: a sticker overlay, visible misalignment, or a resolution mismatch with surrounding print are common signs a genuine code has been covered or replaced. Codes printed by an issuer's production system sit flush with the page layout; a code added later often does not.

Decode with a scanner that displays the raw payload or destination URL before opening it. Check that any URL uses HTTPS and a domain matching the known issuer — a shortened link or unfamiliar domain is a red flag consistent with the quishing pattern Australian authorities have documented. Where the payload is data, cross-check every decoded field against the printed text. A 2D-Doc, or a state digital driver licence QR, is verifiable through a compliant reader that checks the signature, not just the text, while a plastic licence's barcode or magnetic stripe only ever confirms internal consistency.

Why Code Verification Is One Layer, Not the Whole Answer

QR and barcode verification catches a meaningful share of low-effort forgeries, but it is blind to anything outside the code — a consistent edit to both text and payload passes a barcode-only check every time. This mirrors the broader pattern in fraud detection: according to the ACFE 2024 Report to the Nations, manual fraud detection methods catch only 37% of cases, with an average detection delay of 87 days — a real constraint for AUSTRAC-regulated entities running customer identification programs under the AML/CTF Act 2006.

Our platform applies multi-layer analysis — structural, metadata, and cross-document consistency — rather than treating a scannable code as proof on its own, checking code format and payload alongside document layout, field consistency, and metadata across the 3,200+ document types and 32 jurisdictions CheckFile supports. No single check should be the sole basis for an accept or reject decision in a regulated workflow such as banking KYC onboarding, a principle set out further in our document verification guide.

Barcode and QR analysis also says nothing about whether a document was generated wholesale by AI rather than edited from a genuine template. CheckFile's structural and code-level checks complement, rather than replace, deeper forensic and AI-generation detection: our AI and deepfake document detection routes to CheckFile's forensic partner Label4 for that layer, and no solution, including this one, claims to detect every forgery. More on how these layers fit into overall security is on our security page; current plans are on the pricing page.

Frequently Asked Questions

Does a QR code on a document always mean it is genuine

No. A plain data-carrier code can be freely recreated by a forger, while a signed code like France's 2D-Doc or a NSW or Queensland digital driver licence QR can be verified against the issuer's signature. Check which model the document type is supposed to use before treating a scan as reassurance.

Can the MRZ on an Australian passport be forged without detection

ICAO 9303's check-digit algorithm makes altered MRZ data detectable when it does not match its check digit, but the MRZ is not a full signature. A forger who correctly recalculates every digit can still pass an MRZ-only check, so Australian passport verification also relies on physical security features and chip-based checks.

Does Australia have a signed QR code standard like France's 2D-Doc

Not a single nationwide standard yet. The Digital ID Act 2024 established AGDIS and myID for federal services, with private-sector participation opening from 30 November 2026, while NSW and Queensland already run signed digital driver licence QR codes verifiable through their official checker apps — closer to 2D-Doc than to a plastic card's barcode.

Should a business rely on QR code scanning alone to accept a document

No. A defensible process treats a scan as one input among several, alongside layout consistency, metadata inspection, and cross-field checks, because a scan alone cannot distinguish a signed code from a freely recreated one. AUSTRAC-regulated entities should document a multi-signal process rather than a single scan-based gate.

---

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.