Passport and ID Recognition for KYC: How It Works
Practice4 minInnovialabs editorial team
In short
Automated KYC reads the MRZ and visual fields of a document, checks them against each other, confirms a live person matches the photo, looks for signs of forgery and then stores the minimum data needed under strict access rules.
How document recognition for KYC works
A typical remote identity check has five steps:
- Capture: the user photographs the document and takes a selfie.
- Reading: the system reads the MRZ (machine-readable zone), extracts printed fields with OCR and, on e-passports and modern ID cards, can read the NFC chip.
- Consistency checks: MRZ, visual zone and chip data must match, check digits must be valid, the document must not be expired.
- Liveness and face match: a real person is in front of the camera and their face matches the document photo.
- Decision and storage: approve, reject or send to manual review, then store only what the law and the process require.
None of these steps is reliable on its own. The strength of KYC comes from cross-checking them.
MRZ: the most reliable part of the document
The MRZ is the block of text with < characters at the bottom of a passport page or on the back of an ID card. Its format is defined by ICAO Doc 9303:
- TD3 (passports): 2 lines of 44 characters.
- TD1 (ID cards): 3 lines of 30 characters.
It holds the document number, nationality, date of birth, sex, expiry date and name, and key fields are protected by check digits. That makes OCR errors and crude edits easy to catch. Digits keep their value, letters A-Z become 10-35, < is 0, values are multiplied by repeating weights 7, 3, 1 and the sum is taken modulo 10.
def mrz_check_digit(field: str) -> int:
weights = (7, 3, 1)
total = 0
for i, ch in enumerate(field):
if ch.isdigit():
value = int(ch)
elif ch.isalpha():
value = ord(ch.upper()) - 55 # A=10 ... Z=35
else:
value = 0 # '<'
total += value * weights[i % 3]
return total % 10
If a check digit does not match, ask for a new photo instead of "correcting" the text by guessing.
Extracting the visual fields
Fields such as the name in the national script, place of birth or personal number are extracted in three stages:
- Detection: find the document borders, correct perspective, crop.
- Classification: identify country, type and template version, so the system knows where each field sits.
- OCR by field: recognise each zone with its expected format (dates, Latin or Cyrillic text, numbers).
Most errors come from the photo, not the model: glare, blur, cropped corners. On-screen hints and automatic capture of a sharp frame help more than a "smarter" OCR model.
Liveness and face matching
Face match compares the selfie with the document photo, or better, with the photo stored in the chip. Liveness confirms the selfie comes from a live person, not from a printed photo, another screen, a mask or a generated video injected into the camera stream.
| Approach | How it works | Trade-off |
|---|---|---|
| Active | The user turns their head, blinks, follows a dot | Harder to fool, more friction |
| Passive | The model analyses one or several frames | Smoother UX, needs a strong model and anti-injection protection |
For high-risk flows, combine both and protect the capture channel: replacing the camera feed bypasses any face analysis.
Forgery checks
- MRZ vs visual zone: the same name, number and dates in both places.
- Template conformity: fonts, field positions, background patterns of that document version.
- Signs of editing: inconsistent noise, sharp edges around replaced text or photo.
- Screen capture: moiré, pixel grids, monitor reflections.
- Security features: holograms can be checked on video when the document is tilted.
- NFC chip: chip data is signed by the issuing country; verifying that signature (Passive Authentication) is the strongest check available.
- Business rules: expiry, duplicates across accounts, age limits.
Unclear cases go to manual review, never to auto-approval.
Storing scans and personal data
Passport scans and biometrics are among the most sensitive data a company can hold.
- Collect only what you need and state the purpose in the consent text.
- Check local law: many countries, including Uzbekistan, regulate personal data processing and may require citizens' data to be stored on servers inside the country.
- Encrypt scans at rest and in transit, keep keys separate from storage.
- Restrict access to a few roles and log every view of a scan.
- Set retention periods and delete or anonymise data automatically when they end.
- Mask data in logs and support tools: a full passport number should never appear in an error log.
- Vet vendors: know where a third-party KYC provider stores data and for how long.