Supported document type
Detect tampered and deepfake Passport
A forged passport is usually a genuine passport with one thing changed: the portrait, a date of birth, or an expiry year edited on the data page while the machine-readable zone underneath still describes the original holder. Because the MRZ carries its own check digits and repeats the data printed above it, that contradiction is measurable rather than a matter of opinion. TamperCheck reads both halves of the data page and reports where they disagree.
API slug: passport
Last updated:
What a genuine passport contains
A passport data page follows an international standard, so the same fields appear whatever the cover says: surname and given names, nationality, date and place of birth, sex, passport number, issuing state and authority, date of issue, date of expiry, the holder's portrait, and a signature. Below all of it sit two machine-readable lines of 44 characters each, repeating the same data in a fixed layout. Modern books add a contactless chip holding a signed copy of that record, laser-engraved lettering, and optically variable ink in the substrate.
Those elements are deliberately redundant. The machine-readable zone repeats the passport number, the date of birth, and the expiry date, and each is followed by a check digit computed from the characters before it, with a final digit covering the composite. Change a birth year in the printed zone and the MRZ contradicts it. Recompute the MRZ to match and the chip, which is cryptographically signed by the issuing state, still holds the original values. A forger has to win in three places at once.
How passport forgeries are made
Portrait substitution on the data page
A replacement face is composited into the photo zone. On a genuine page the portrait is engraved into the same layer as the background security pattern, so the pattern runs through it. A pasted portrait sits above that pattern and carries its own noise level, sharpness, and colour temperature.
MRZ recomposition
The two machine-readable lines are rewritten so they agree with edited names or dates above them. Recomputing the check digits is trivial. Matching the character spacing, stroke weight, and baseline of the original OCR-B print is not, and a regenerated zone usually renders too cleanly against the page around it.
Date of birth and expiry edits
A birth year is moved to clear an age threshold, or an expiry year is pushed forward so a lapsed book reads as current. The edit touches two or three characters in the visual zone and leaves the machine-readable lines, the chip, and the document number checksum describing something else.
Flattened security printing
Genuine passports carry foil and optically variable ink that change appearance as the page tilts. A scan, a reprint, or a digital overlay fixes one appearance permanently, so the feature reads as a static pattern with none of the hue shift the real thing produces under moving light.
Data page replacement
The whole biodata page is lifted out of a genuine book and a new one bonded in. Stitching, page numbering, and the perforated passport number that should run through every page are where it fails, and on a scan the replacement rarely matches the other pages for paper tone and print density.
Wholly generated data pages
Some books never existed as paper. The page is rendered from a template complete with a plausible machine-readable zone, so every internal cross-check agrees. Detection moves to the imaging layer: generation artefacts, an absent capture history, and substrate texture that does not behave like polycarbonate under a phone camera.
What TamperCheck checks on a passport
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Machine-readable zone validation
Check digits across every MRZ field are recomputed, and the encoded name, number, and dates are compared against the values printed on the face of the document. Forgers routinely update one and forget the other.
Portrait substitution and face-swap analysis
The document is isolated from whatever it was photographed on, then the portrait region is assessed against the card surface around it. A pasted or generated face rarely matches the substrate it was placed onto.
Security print, foil, and hologram analysis
A genuine security overlay or guilloche background behaves differently from a printed picture of one. A reproduction loses the structure that made the feature a security feature in the first place, and that loss is measurable even when the copy looks convincing on screen.
And many more checks
The three above are the layers that carry the most weight on a passport. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a passport, and why
KYC teams, immigration officers, and regulated businesses confirming nationality. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a passport in 4 steps
Verify the MRZ check digits
The second machine-readable line places a check digit after the passport number, the date of birth, and the expiry date, with a composite digit covering all of them. Compute each from the characters it covers. A digit that does not match means the line was edited or regenerated rather than printed by the issuing state.
Read the MRZ against the printed zone
Every value in the machine-readable zone also appears in the visual zone above it. Compare them side by side: surname, given names, nationality, sex, date of birth, passport number, expiry. Editing one zone and forgetting the other is the most common failure in a forged data page.
Make the security features move
Foil, optically variable ink, and laser-engraved lettering change with the viewing angle, which a single still image cannot reproduce. Where the passport is only ever seen as an upload, ask for a short capture in motion rather than a flat photograph of the page.
Run a forensic check on the file
Checksums pass on any competently rebuilt MRZ, and a well-composited portrait survives careful visual inspection. TamperCheck runs 200+ forensic checks on the data page and returns a risk score from 0 to 100 within seconds, with findings tied to specific regions of the image.
Frequently asked questions
How do I know if a passport is fake?
Compare the machine-readable zone against the printed fields above it and verify its check digits, because that is where an edited passport contradicts itself. Then check that the portrait is engraved into the page rather than laid over it, that the security print shifts as the page tilts, and that the expiry date is consistent with the issue date and the issuing state's term.
How do banks verify passport scans?
Banks parse the machine-readable zone, validate its check digits, compare it field by field against the printed data, and match the portrait against a selfie or liveness capture. A scan strips away every physical cue the book was designed around, so the remaining weight falls on what the file itself reveals about how the page was produced.
Can AI generate a passport that passes KYC?
Yes, for any check that only reads fields. A generated data page can carry a valid machine-readable zone, a consistent set of dates, and a face that belongs to nobody, so checksum and cross-field validation agree with each other. What it does not reproduce is capture history: generated imagery has different noise and frequency characteristics from a real page photographed or scanned.
What is the MRZ on a passport?
The MRZ is the block of two 44-character lines at the foot of the data page, holding the holder's name, nationality, date of birth, sex, passport number, and expiry date in a fixed international layout. Each of those values is followed by a check digit calculated from it, which is what turns the zone into a verification tool rather than a convenience for scanners.
Can a passport be checked from a photo?
Yes, and in remote onboarding it is the only option available. An upload still carries the machine-readable zone, the print structure of the page, the boundary around the portrait, and the compression history of the file itself. TamperCheck analyses a passport image through a single REST endpoint and returns a JSON verdict, with the document processed ephemerally and not stored.
TamperCheck analyses passport uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.