How to Verify a QR Code or Barcode on Official Documents

Verifying a QR code or barcode on a US identity document means checking not just that it scans, but what it actually proves: a cryptographic signature tied to the issuing state, or merely a convenience encoding of printed text. A mobile driver's license built on ISO/IEC 18013-5 is cryptographically signed by the issuing DMV, while the PDF417 barcode on most physical driver's licenses simply repeats visible data and can be regenerated with the right software. This guide explains how to tell the difference.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.

---

What Does a QR Code or Barcode on a Document Actually Prove

A QR code or barcode proves only what its payload contains — nothing more. Two documents can look identical at a glance, one carrying a code that cryptographically signs the printed content and one that merely stores a copy of the same text, and a scanning app will happily open both. The real question is not "does it scan" but what data model sits behind the scan.

Three models exist in practice: a plain data carrier stores a copy of printed fields with no cryptographic link to an issuer; a verification-URL carrier points to a web page or state database checking the document against a live record; a cryptographically signed carrier contains a digital signature, generated with the issuer's private key, verifiable against a public key. US mobile driver's licenses, built on the ISO/IEC 18013-5 standard, are the clearest large-scale domestic example of the signed model — each credential carries a mobile security object signed by the issuing DMV (TSA: REAL ID Mobile Driver's Licenses).

Is a Scannable QR Code or Barcode Proof That a Document Is Genuine

A scannable code is not proof of genuineness, because a fraudster can encode whatever payload they choose and print it onto a forged document. What matters is whether the decoded content can be checked against a source the fraudster does not control. Users on identity-verification forums often ask whether a barcode that decodes cleanly back to the printed details means the card itself is genuine — it does not. It depends entirely on the format.

A code built on a plain data-carrier model, like most driver's license PDF417 barcodes, only demonstrates internal consistency, not authenticity. AAMVA-format PDF417 barcodes on US and Canadian licenses hold roughly 1,100 bytes — typically the same name, date of birth, license number, and address already printed on the card — protected by Reed-Solomon error correction but, in most jurisdictions, carrying no cryptographic link to the issuer. A verifier scanning it is cross-checking OCR'd printed text against barcode text; if a forger edits both consistently, the barcode "matches" a document that is entirely fake. A handful of states have begun adding a signed subfile under AAMVA's 2025 Card Design Standards revision, but this remains the exception across the roughly fifty issuing jurisdictions.

How Does an ISO 18013-5 Mobile Driver's License Differ From a Signed Document Standard Like 2D-Doc

A mobile driver's license proves authenticity the same structural way France's 2D-Doc does — through an issuer-signed payload rather than a copy of printed fields. 2D-Doc, specified by France Titres in its cahier des charges v3.3.4 of 17 June 2024, embeds an asymmetric cryptographic signature in a Datamatrix code, verifiable offline against the relevant public key certificate (ANTS technical specification, PDF). A US mDL does the equivalent job over Bluetooth, NFC, or a QR-initiated session instead of a printed code: the credential includes a mobile security object signed by the issuing DMV, validated live by a compliant reader rather than trusted from a static image — a 2D-Doc signature, by contrast, can be checked from a printed page years after issuance.

What Is the MRZ and How Does It Detect Forged US Passports

The Machine Readable Zone (MRZ) is the two-line OCR-B text block at the base of a US passport's photo page, structured under ICAO Doc 9303 so every field carries an algorithmically computed check digit. If a fraudster alters a date of birth, passport number, or expiration date without correctly recalculating the check digit, the mismatch is detectable by any reader running the ICAO algorithm offline — the same logic behind running a passport, presented as a Form I-9 List A document, through E-Verify against DHS and SSA records rather than accepting it on sight.

A mismatch between printed visual data and MRZ-derived data, or between the MRZ and its own check digits, is an automatically detectable forgery signal defined by ICAO 9303. The MRZ is not a barcode at all, but its self-checking arithmetic gives it built-in consistency verification that plain barcodes lack, even without a full cryptographic signature. See our guide to fake passport fraud detection for more.

Comparing QR and Barcode Verification Standards

No two code standards prove the same thing. The table below sets out what each actually proves, and its limitation in isolation.

Under eIDAS 2, all 27 EU member states must offer citizens a digital identity wallet by December 2026 — a rollout that mirrors, at larger scale, the state-by-state mDL expansion already underway in the US. Our eIDAS 2 wallet guide covers that timeline.

How REAL ID and mDL Acceptance Actually Work

REAL ID enforcement at federal checkpoints began on May 7, 2025, reshaping which credentials TSA and other federal agencies accept for official purposes. Under 6 CFR 37.7, a federal agency may accept a state's mDL only if that state has received a waiver, or the agency has adopted an alternative acceptance policy (Federal Register: mDL waiver rule). An mDL is not automatically valid everywhere a physical REAL ID-compliant license is: TSA lists a limited, growing set of participating states and airports, so travelers should check the current list rather than assume acceptance (TSA: digital ID participating states).

California alone had issued 2,654,774 mDLs as of August 2025, and its DMV publishes reader specifications for businesses that want to verify one directly rather than accept a screenshot (California DMV: mDL Reader).

Can Someone Fake a QR Code on a Pay Stub or Bank Document

Yes — a QR code on a pay stub or bank document can be faked whenever it is a plain data carrier or points to a website the fraudster also controls. A convincing forgery only needs a QR image with plausible text, or a lookalike domain. This is also why "quishing" — a fraudulent sticker placed over a legitimate code, or a malicious code substituted for a real one — has been the subject of consumer alerts from the FBI and the FTC, distinct from but related to document forgery.

Only a verification flow that checks whether the destination domain matches the genuine issuer, whether the payload format matches known genuine samples, and whether the surrounding document is internally consistent gives a defensible answer. Identity fraud is not a marginal concern for US financial institutions: FinCEN's analysis of Bank Secrecy Act filings found 42% of suspicious activity reports reviewed, worth $212 billion, were identity-related, and separately warned in 2024 that criminals increasingly use AI to generate falsified identity documents and photographs during onboarding (FinCEN: Identity-Related Suspicious Activity; FinCEN Alert FIN-2024-Alert004).

How to Manually Check a QR Code or Barcode for Signs of Forgery

Inspect the code's physical placement before scanning: a sticker overlay, visible misalignment, or a resolution mismatch with surrounding print are common signs a genuine code has been covered or replaced. Codes printed by an issuer's production system sit flush with the page layout; a code added later often does not.

Decode with a scanner that displays the raw payload or destination URL before opening it. Check that any URL uses HTTPS and a domain matching the known issuer — a shortened link or unfamiliar domain is a red flag consistent with the quishing pattern federal agencies have documented. Where the payload is data, cross-check every decoded field against the printed text; any mismatch is worth escalating. An mDL should be verifiable through a compliant ISO 18013-5 reader that checks the issuer signature live, while a PDF417 barcode only ever confirms internal consistency — the wrong code format for a claimed document type is itself a fraud signal.

Why Code Verification Is One Layer, Not the Whole Answer

QR and barcode verification catches a meaningful share of low-effort forgeries, but it is blind to anything outside the code — a forgery that edits printed text and payload consistently passes a barcode-only check every time. This mirrors the broader pattern in fraud detection: according to the ACFE 2024 Report to the Nations, manual fraud detection methods catch only 37% of cases, with an average detection delay of 87 days.

Our platform applies multi-layer analysis — structural, metadata, and cross-document consistency — rather than treating a scannable code as proof on its own, checking code format and payload alongside document layout, field consistency, and metadata across the 3,200+ document types and 32 jurisdictions CheckFile supports. No single check should be the sole basis for an accept or reject decision in a regulated workflow such as bank KYC onboarding, a principle covered further in our document verification guide.

Barcode and QR analysis also says nothing about whether a document was generated wholesale by AI rather than edited from a genuine template. CheckFile's structural and code-level checks complement, rather than replace, deeper forensic and AI-generation detection: our AI and deepfake document detection routes to forensic partner Label4 for that layer, and no solution, including this one, claims to detect every forgery. More on these layers is on our security page; plans are on the pricing page.

Frequently Asked Questions

Does a QR code or barcode on a document always mean it is genuine

No. A plain data-carrier code, like most driver's license PDF417 barcodes, can be freely recreated by a forger, while a signed credential like a mobile driver's license or France's 2D-Doc can be independently verified against the issuer's cryptographic key. Check which model a document type is supposed to use before treating a scan as reassurance.

What is the difference between a barcode that stores data and one that carries a digital signature

A data-storing barcode, such as most PDF417 codes on driver's licenses, repeats printed fields with no cryptographic link to the issuer. A signature-carrying credential, such as an ISO 18013-5 mobile driver's license or France's 2D-Doc, embeds a signature a reader can validate against the issuer's public key, live or offline.

Can the MRZ on a US passport be forged without detection

ICAO 9303's check-digit algorithm makes altered MRZ data detectable when it does not match its check digit, but the MRZ is not a full signature. A forger who correctly recalculates every digit can still pass an MRZ-only check, so passport verification also relies on physical security features and chip-based checks.

Is a screenshot of a mobile driver's license the same as a verified mDL

No. A screenshot of an mDL's on-screen QR code carries none of the cryptographic session data a compliant ISO 18013-5 reader checks during a live tap, Bluetooth, or server-retrieval exchange. Treat a static image the same as a plain barcode: it proves the image exists, not that the credential is valid.

Should a business rely on QR code or barcode scanning alone to accept a document

No. A defensible process treats a scan as one input among several, alongside layout consistency, metadata inspection, and cross-field checks, since a scan alone cannot distinguish a signed credential from a freely recreated one. Regulated firms should document a multi-signal process, not a single scan-based gate.

---

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.