How to Verify a QR Code or Barcode on Official Documents

Verifying a QR code or barcode on an official document means checking not just that it scans, but what it actually proves: a cryptographic signature tied to the issuer, or merely a convenience encoding of printed text. A scannable code is not automatic evidence of authenticity — France's 2D-Doc and the EU Digital Identity Wallet are cryptographically signed, while the PDF417 barcode on the back of a Canadian driver's licence simply repeats visible data and can be regenerated with the right software. This guide explains how to tell the difference.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.

---

What Does a QR Code or Barcode on a Document Actually Prove

A QR code or barcode proves only what its payload contains — nothing more. Two documents can look identical at a glance, one carrying a code that cryptographically signs the printed content and one that merely stores a copy of the same text, and a scanning app will happily open both. The real question is not "does it scan" but what data model sits behind the scan.

Three models exist in practice: a plain data carrier stores a copy of printed fields with no cryptographic link to an issuer; a verification-URL carrier points to a web page that checks the document against a live database; a cryptographically signed carrier contains a digital signature, generated with the issuer's private key, verifiable offline against a public key. France's 2D-Doc standard, specified by ANTS in its cahier des charges v3.3.4 of 17 June 2024, is the clearest large-scale example of the signed model, used on over 50 official French document types since income tax notices adopted it in April 2022 (ANTS 2D-Doc specification). Canada has no equivalent standard deployed at that scale yet.

Is a Scannable QR Code Proof That a Document Is Genuine

A scannable QR code is not proof of genuineness, because a fraudster can encode whatever payload they choose and print it onto a forged document. What matters is whether the decoded content can be checked against a source the fraudster does not control. Users on Canadian personal-finance and identity forums often ask a version of this question directly — whether a barcode that scans cleanly means the card behind it is real, or whether "it scanned" just means the two numbers on the front and back happened to match. It depends entirely on the format.

A code built on a plain data-carrier model, like the PDF417 barcode on the back of every Canadian provincial driver's licence, only demonstrates internal consistency, not authenticity. AAMVA-format PDF417 barcodes used on Canadian and American licences alike hold roughly 1,100 bytes of data, typically the same name, date of birth, and address already printed on the card, with no cryptographic link to the issuing province. A verifier scanning it is cross-checking OCR'd printed text against barcode text; if a forger edits both consistently, the barcode "matches" a document that is entirely fake.

How Does France's 2D-Doc Standard Prove Document Authenticity

France's 2D-Doc proves authenticity because its Datamatrix code embeds an asymmetric cryptographic signature computed by the issuing authority, not merely a copy of the printed fields. The 2D-Doc cahier des charges (v3.3.4, published 17 June 2024 by France Titres) defines a signed payload structure covering identity documents, tax notices, and utility bills, verifiable offline by any reader holding the relevant public key certificate (ANTS technical specification, PDF). A verifier decodes the Datamatrix, extracts the signed data block and signature, and confirms mathematically that the data has not changed since it was signed.

A French avis d'imposition, mandatory since April 2022, cannot be forged by editing the visible numbers alone, because the signature would no longer validate. For a Canadian verifier handling French documents in a KYC flow, scanning confirms the code decodes — only signature verification against the correct public key confirms the document is genuine.

What Is the MRZ and How Does It Detect Forged Canadian Passports

The Machine Readable Zone (MRZ) is the two-line OCR-B text block at the base of a Canadian passport's photo page, structured under ICAO Doc 9303 so every field carries an algorithmically computed check digit. If a fraudster alters a date of birth, document number, or expiry date without correctly recalculating the check digit, the mismatch is detectable by any reader running the ICAO algorithm, offline.

A mismatch between printed visual data and MRZ-derived data, or between the MRZ and its own check digits, is an automatically detectable forgery signal defined by ICAO 9303, and it applies identically to Canadian passports issued by IRCC as it does to passports from any other ICAO member state. The MRZ is not a barcode at all, but its self-checking arithmetic gives it built-in consistency verification plain barcodes lack, even without a full cryptographic signature. See our guide to fake passport fraud detection for more.

Comparing QR and Barcode Verification Standards

No two code standards prove the same thing, and mixing up their guarantees is a common verification mistake. The table below sets out what each proves, and its limitation in isolation.

Under eIDAS 2, all 27 EU member states must offer citizens a digital identity wallet by December 2026, with financial institutions expected to accept wallet credentials within 36 months of the implementing acts entering into force, targeting December 2027. Its QR codes enable cross-device authentication, but the trust anchor is the underlying credential, not the QR image — closer to 2D-Doc than to a static barcode. Our eIDAS 2 wallet guide covers the rollout timeline.

What Is Canada's Equivalent to a Signed Document QR Code

Canada does not yet have a nationwide cryptographically signed document standard comparable to 2D-Doc, though the building blocks are emerging province by province. Ontario has introduced a digital ID option letting residents store their driver's licence in a mobile wallet, with adoption voluntary across the country as of 2026 (ontario.ca: where digital ID could be used). No province has replaced the plain-data PDF417 barcode on physical licences with a signed equivalent at scale, and the federal Pan-Canadian Trust Framework governs how a digital credential is trusted rather than defining a signed-barcode format the way 2D-Doc does in France.

For reporting entities under the PCMLTFA, FINTRAC's guidance now permits digital copies of government-issued photo ID, provided the entity confirms the document is authentic, valid, and current — a change from the older requirement that documents be reviewed in original form (FINTRAC: methods to verify the identity of persons and entities). In practice, that means software assessing security features, not a barcode scan confirming the payload matches the printed fields. A PDF417 barcode that decodes cleanly is a starting point for that check, not a substitute for it.

Can Someone Fake a QR Code on a Pay Stub or CRA Document

Yes — a QR code on a pay stub, bank statement, or CRA notice of assessment can be faked whenever it is a plain data carrier or points to a website the fraudster also controls. A convincing forgery only needs a QR image with plausible text, or a lookalike domain, neither requiring specialist skill. This is also why quishing — a fraudulent sticker placed over a legitimate code — is a recognised fraud pattern on parking machines and official-looking mail in Canada, flagged by police services as related to, but distinct from, document forgery.

Only a verification flow that checks whether the destination domain matches the genuine issuer, whether the payload format matches known genuine samples, and whether the surrounding document is internally consistent gives a defensible answer. Our guide to government ID verification and digital identity programs covers a parallel case where scan-only checks are insufficient for identity documents more broadly.

How to Manually Check a QR Code or Barcode for Signs of Forgery

Inspect the code's physical placement before scanning: a sticker overlay, visible misalignment, or a resolution mismatch with surrounding print are signs a genuine code has been covered or replaced. Codes printed by an issuer's production system sit flush with the page layout; a code added later often does not.

Decode with a scanner that displays the raw payload or destination URL before opening it. Check that any URL uses HTTPS and a domain matching the known issuer — a shortened link or unfamiliar domain is a red flag consistent with the quishing pattern described above. Where the payload is data, cross-check every decoded field against the printed text; any mismatch is worth escalating. A 2D-Doc should be verifiable through a compliant reader that checks the signature, not just decodes text, while a provincial PDF417 barcode only ever confirms internal consistency — the wrong code format for a claimed issuer is itself a fraud signal.

Why Code Verification Is One Layer, Not the Whole Answer

QR and barcode verification catches a meaningful share of low-effort forgeries, but it is blind to anything outside the code — a forgery that edits printed text and payload consistently passes a barcode-only check every time. This mirrors the broader pattern in fraud detection: according to the ACFE 2024 Report to the Nations, manual fraud detection methods catch only 37% of cases, with an average detection delay of 87 days, underscoring why single-signal checks alone are insufficient.

Our platform applies multi-layer analysis — structural, metadata, and cross-document consistency — rather than treating a scannable code as proof on its own, checking code format and payload alongside document layout and field consistency across the 3,200+ document types and 32 jurisdictions CheckFile supports. No single check should be the sole basis for an accept or reject decision in a regulated workflow such as banking KYC onboarding, a principle set out further in our document verification guide.

Barcode and QR analysis also says nothing about whether a document was generated wholesale by AI rather than edited from a genuine template, a separate and growing risk. CheckFile's structural and code-level checks complement, rather than replace, deeper forensic and AI-generation detection: our AI and deepfake document detection routes to CheckFile's forensic partner Label4 for that layer, and no solution, including this one, claims to detect every forgery. More on how these layers fit together is on our security page; current plans are on the pricing page.

Frequently Asked Questions

Does a QR code on a document always mean it is genuine

No. A plain data-carrier code can be freely recreated by a forger, while a signed code like France's 2D-Doc can be independently verified against the issuer's public key. Check which model the document type is supposed to use before treating a scan as reassurance.

What is the difference between a barcode that stores data and one that carries a digital signature

A data-storing barcode, such as the PDF417 code on a Canadian provincial driver's licence, repeats printed fields with no cryptographic link to the issuer. A signature-carrying code, such as France's 2D-Doc, embeds a signature a reader can validate offline against the issuer's public key.

Can the MRZ on a Canadian passport be forged without detection

ICAO 9303's check-digit algorithm makes altered MRZ data detectable when it does not match its check digit, but the MRZ is not a full signature. A forger who correctly recalculates every digit can still pass an MRZ-only check, so passport verification also relies on physical security features and chip-based checks.

Does FINTRAC allow digital identity documents to be verified remotely

Yes. FINTRAC's guidance permits reliance on digital copies of government-issued photo ID, provided the reporting entity can establish the document is authentic, valid, and current, typically through software that checks security features rather than a barcode scan alone. A PDF417 barcode that decodes cleanly does not, by itself, satisfy that authenticity standard.

Should a business rely on QR code scanning alone to accept a document

No. A defensible process treats a scan as one input among several, alongside layout consistency, metadata inspection, and cross-field checks, because a scan alone cannot distinguish a signed code from a freely recreated one. Regulated entities under the PCMLTFA should document a multi-signal process rather than a single scan-based gate.

---

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.