Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
The travel-and-identity document examination workflow: the ICAO Doc 9303 machine-readable travel document standard (the MRZ machine-readable zone, the OCR-B typeface, the check-digit algorithm), biometric chip integrity (BAC, EAC and PACE access control), the security-printing techniques shared across passports, visas and modern driving licences (microprinting, OVI, KINEGRAM and similar diffractive optically variable image devices, UV-fluorescent inks), the document-fraud taxonomy (photo substitution, page substitution, alteration, impersonation, look-alike fraud), and the FRONTEX / Interpol / NCRB casework lens.
Last updated:
A passport is, in its simplest legal definition, a travel document issued by a state certifying the bearer's nationality and identity and requesting safe passage from foreign authorities. In its forensic definition, a passport is a security-printed booklet conforming to ICAO Doc 9303 (the International Civil Aviation Organization's Machine Readable Travel Documents standard), incorporating a layered set of substrate, printing, and digital security features whose integrity allows a border officer or forensic document examiner to determine whether the document is genuine, whether its data page has been altered, whether the photograph is the original, and whether the holder is the person to whom the document was issued.
ICAO 9303 (eighth edition, 2021) is the technical backbone of the global passport system. Every ICAO member state issuing a passport is required to conform to its specifications: OCR-B font in the machine-readable zone (MRZ), specific field structure and check-digit algorithm, minimum chip data groups for e-Passports, and minimum security printing specifications for the biographical data page. The standard's global reach means that a forensic document examiner in Chennai, London, Frankfurt, or Washington DC follows the same examination protocol for a suspect Indian, UK, German, or US passport, because all four are supposed to implement the same ICAO 9303 framework.
Driving licences and national identity cards present a related but distinct challenge. Unlike passports, which are governed by a single international standard, driving-licence formats are set by national or sub-national authorities, with no universal equivalent of ICAO 9303. The Vienna Convention on Road Traffic (1968) governs mutual recognition of driving licences across signatory states, but the physical security specifications are national. EU Directive 2006/126/EC standardised driving-licence format within the EU from 2013; the US relies on AAMVA (American Association of Motor Vehicle Administrators) standards; India's Motor Vehicles Act and the Central Motor Vehicles Rules govern Indian DL specifications. This national fragmentation means a document examiner working a driving-licence fraud case must first identify the issuing authority's specific security printing specification before beginning examination.
The machine-readable zone is simultaneously the most standardised element of a passport and the element most vulnerable to alteration, because its content is machine-parsed rather than visually assessed.
Test yourself on Questioned Document with free, timed mocks.
Practice Questioned Document questionsICAO Doc 9303 Part 3 specifies the machine-readable zone format for travel-sized documents (TD1: ID card size, 3 lines x 30 characters; TD2: smaller booklet or card, 2 lines x 36 characters; TD3: full-page passport biographical data page, 2 lines x 44 characters). The vast majority of passports in global circulation use the TD3 format.
Line 1 (the upper MRZ line) carries: document type (P for passport, V for visa), issuing state code (three-letter ICAO 3166-1 alpha-3 code: IND for India, GBR for United Kingdom, USA for United States, DEU for Germany), and the surname and given names of the holder, padded to 44 characters with the filler character < (a less-than symbol). Line 2 (the lower MRZ line) carries: document number (nine characters); check digit over the document number; nationality code; date of birth (YYMMDD); check digit over date of birth; sex (M, F, or X); date of expiry (YYMMDD); check digit over date of expiry; optional data (personal number or other national field); check digit over the optional data field; and a final composite check digit over specified fields.
The check-digit algorithm is a weighted sum over the character values of the field, with weights cycling through 7, 3, 1 per character position, and the result taken modulo 10. Each character has a numeric value: digits 0-9 have their face value; the filler character < has value 0; letters A-Z have values 10-35. A forger who alters a date of birth or document number in the VIZ (visual inspection zone, the humanly readable text above the MRZ) but does not update the MRZ will produce an MRZ check-digit mismatch detectable by any document-reading device at a border control point.
A forger who does update both the VIZ and the MRZ (a more sophisticated alteration) must physically alter the printed MRZ characters on the page, which under magnification shows the alteration through: ink-layer discontinuity at the alteration point; absence of the security overprint pattern at the altered character; and, in laser-engraved pages, the absence of the characteristic laser-ablation profile in the altered numeral or letter.
The biometric chip in an e-Passport is not just a data store; it is a cryptographically authenticated record whose integrity can be verified without contacting the issuing state.
ICAO 9303 Part 9 specifies the e-Passport chip architecture: a contactless integrated circuit (typically conforming to ISO/IEC 14443, the contactless smart card standard) embedded in the passport cover or within the biographical data page substrate. The chip carries Data Groups (DG1 through DG16) containing the MRZ data, the holder's facial image (DG2), fingerprint templates (DG3, DG4, access-controlled), iris images (DG5, DG6, access-controlled), and other national data groups.
Access to chip data is controlled by three mechanisms specified in ICAO 9303: Basic Access Control (BAC), Extended Access Control (EAC), and Password Authenticated Connection Establishment (PACE). BAC uses the MRZ data printed on the biographical page as a cryptographic key to derive a session key, which means the chip data can only be read by a device that has optically read the MRZ (preventing contactless skimming of the chip without physical possession of the passport). EAC provides a second access control layer, governed by certificates issued by the inspecting state, to access fingerprint and iris data groups. PACE, the successor to BAC, provides a more cryptographically robust key-establishment protocol using the document's Card Access Number (CAN) or MRZ data.
Passive Authentication (PA) is the mechanism by which the chip's integrity is verified without contacting the issuing state in real time: the chip stores a Document Security Object (DSO), which is a digital signature by the issuing state's Document Signer Certificate (DSC) over a hash of each Data Group. Any modification of chip data breaks the hash and hence the DSO signature. A border control reader verifies the DSO against the issuing state's DSC, whose chain of trust is published on the ICAO Public Key Directory (PKD). A chip that fails Passive Authentication indicates data modification (tampering with the biometric or the MRZ DG1 data).
Active Authentication (AA) prevents chip substitution: the chip contains a private key used to sign a reader challenge; the public key on the chip is authenticated via the DSO chain. A chip transplanted from a different genuine passport fails Active Authentication because the private key does not match the public key in the DSO.
For a forensic document examiner, the chip examination workflow begins with a contactless card reader and specialist software (PassiveAuth, JMRTD, or proprietary border-system tools). A failed Passive Authentication or Active Authentication result is a forensic indicator of electronic data manipulation and must be reported alongside the physical examination findings.
The passport biographical data page is the most security-printed surface in everyday civilian use, combining at least eight distinct security features in a space the size of a playing card.
The biographical data page of a contemporary ICAO 9303-compliant passport concentrates more security-printing technology per square centimetre than any other document in ordinary civilian use. The specific combination of features varies by issuing state but the ICAO 9303 minimum specifications (combined with the recommendations from the ICAO NTWG, the Technical Advisory Group on Machine Readable Travel Documents) produce a common core across major-issuing states.
The Indian passport (redesigned series from 2021) carries: a laser-engraved portrait and biographical data (laser engraving burns the printed layers to produce a permanent, tactile record resistant to the chemical bleaching attacks that affect inkjet-over-paper designs); a colour-shift OVI ghost portrait in the lower right of the biographical page; microprinting in the page border and in the background security print; UV-fluorescent security printing in a pattern visible under 365 nm UV across the biographical page surface; and a polycarbonate data page (replacing the earlier laminated paper page) in which the biographical data is embedded within the polycarbonate layers rather than printed on the surface, making delamination attacks that allow photo substitution unsuccessful because the portrait is within the material rather than on it.
The UK passport (redesigned 2019, manufactured by De La Rue) uses a similar polycarbonate laser-engraved biographical page and adds a KINEGRAM holographic foil patch on the biographical page and on the inside front cover. The KINEGRAM shifts between a gold-tinted Royal coat of arms and a full-colour image of the holder depending on the viewing angle. The US passport (redesigned 2021, manufactured by the US Government Publishing Office's Security and Intelligent Documents Unit) uses a polycarbonate laser-engraved data page with a colour-shifting electronic-pattern OVI element, UV-fluorescent inkings across all biographical data fields, and a microprinted border. German passports (Bundesdruckerei) use a similar polycarbonate architecture with KINEGRAM, laser engraving, and a microprinted security laminate.
Visa labels (affixed to passport pages by consular officers) carry their own security features: for Schengen visas, the Schengen visa sticker (produced by the EU's centralised security printer) carries a KINEGRAM stripe, OVI numeral, guilloché background pattern, UV-fluorescent security inks, and laser-personalised holder data. Indian visas (affixed by Indian Missions abroad) carry a security laminate with holographic elements and microprinting.
| Feature | Indian passport (2021 series) | UK passport (2019 series) | US passport (2021 series) | Schengen visa sticker |
|---|---|---|---|---|
| Biographical page substrate | Polycarbonate (PC) | Polycarbonate (PC) | Polycarbonate (PC) | Security paper sticker with PC laminate |
| Portrait personalisation | Laser engraving (in PC layers) | Laser engraving (in PC layers) | Laser engraving (in PC layers) | Laser personalised |
| Holographic/OVI device | Colour-shift OVI ghost portrait | KINEGRAM (De La Rue) | OVI colour-shift element |
Every fraud type leaves a specific forensic signature; knowing the taxonomy determines which examination techniques to apply first.
INTERPOL and FRONTEX (the EU's border and coast guard agency) classify travel-document fraud into six primary categories, which are used consistently across law enforcement in India (NCRB data), the UK (National Document Fraud Unit, NDFU), the US (Department of Homeland Security's Document and Benefit Fraud Task Forces), and EU member states.
Counterfeit documents are those produced without authority from scratch, replicating a genuine document's appearance. These are the most easily detected category because they must replicate all security features simultaneously, which requires either access to genuine security-printing equipment and materials (rare) or substitution of simulated features that fail under laboratory examination.
Fraudulently altered documents are genuine documents that have been modified: name change, date of birth change, date of expiry extension, or visa validity modification. Alterations to printed data on a laser-engraved polycarbonate page are physically extremely difficult because the data is in the polycarbonate matrix; alterations to the older laminated paper pages are detectable through laminate disturbance, ink-layer anomaly, or substrate thinning from scraping.
Photo-substituted documents are genuine documents with the original biographical page photograph replaced. In older laminates and in some issuing states' pages with insufficient laminate adhesion, the photograph could be lifted and replaced. Modern polycarbonate pages defeat this attack because the portrait is laser-engraved within the material. Residual cases involve: lifting the laminate and re-laminating with a replacement photograph; trimming and re-inserting a photograph into an intact laminate; or applying a second photograph layer over the first with adhesive, detectable as a raised portrait edge under the laminate.
Page substitution involves replacing one or more interior pages of the booklet (visa pages, endorsement pages) or, in extreme cases, the entire biographical data page. Modern passport sewing and binding techniques leave detectable disturbance: thread pattern mismatch, adhesive residue at the spine, page-thickness discontinuity at the substituted page.
Impersonation fraud presents a genuine document used by a person other than the rightful holder. No physical alteration has occurred; the forensic document examiner has no role in detection (facial comparison by trained border officers or biometric systems is the detection mechanism). However, the associated ePassport chip carries the genuine holder's fingerprints and facial biometrics, which fail biometric comparison against the impersonator at a border equipped with biometric verification.
Look-alike fraud is a variant of impersonation where the fraudster selects a genuine document belonging to a legitimate holder who physically resembles them. Detection relies on the examiner's facial comparison skill and on biometric comparison. In EU border operations, FRONTEX training standards include facial comparison methodology under the standardised FRONTEX detection methodology (now incorporated in the EU Border Guard Common Core Curriculum).
Driving licences are the most frequently presented identity document in everyday transactions, which makes them the most frequently forged identity document in everyday fraud.
The forensic examination of driving licences presents a different challenge from passports: there is no single global standard equivalent to ICAO 9303. The forensic examiner must first correctly identify the claimed issuing authority, locate its security printing specification, and then examine the suspect document against that specification.
In the United States, the AAMVA (American Association of Motor Vehicle Administrators) issues the DL/ID Card Design Standard, which specifies the physical and digital security architecture for state-issued driving licences and identity cards. The standard requires: a PDF417 barcode on the back carrying the encoded holder data; a magnetic stripe (on many states); UV-fluorescent security printing; microprinting; and, in the REAL ID Act compliant versions, a machine-readable zone conforming to ICAO 9303 TD1. The DL format varies significantly by state: a California DL differs in security feature arrangement from a New York DL, which differs from a Texas DL, creating a substantial reference-collection burden for examiners.
EU Directive 2006/126/EC (implemented from January 2013) standardised the EU driving licence format across member states: credit-card size, polycarbonate substrate (in the most recent implementations), laser-engraved holder data, holographic overlay, and consistent field layout with common EU cat code and standardised validity dates. Post-Brexit UK driving licences maintain an identical format to the EU specification as a matter of continuity but are now domestic documents rather than EU community licences.
Indian driving licences are issued under the Motor Vehicles Act 1988 (amended in 2019) and the Central Motor Vehicles Rules 1989. The "Smart Card" driving licence format introduced from 2001 uses a polycarbonate or PVC smart card with an embedded microchip (carrying the holder's data and photograph), laser-engraved or printed holder data on the front face, and a holographic overlay. The Sarathi application (Ministry of Road Transport and Highways) drives the central data system for licence issuance. Forensic examination of suspect Indian DLs must verify: smart card chip data consistency with printed data; holographic overlay continuity (overlay disturbed at portrait or date-of-birth area indicates substitution attempt); and colour-shifting or UV-fluorescent elements in the design.
Common alteration targets on DLs across all jurisdictions include: date of birth (changed to extend use by under-age holders); expiry date (extended to maintain validity); and, in non-polycarbonate cards, photograph substitution through laminate lifting. The physical detection methods parallel those used for passports: transmitted-light inspection, UV examination, oblique-raking-light laminate examination, and microscopic ink-layer examination.
A document examiner's forensic finding is only as useful as the intelligence framework into which it feeds; the three organisations structure that framework across three overlapping geographic jurisdictions.
FRONTEX (European Border and Coast Guard Agency) coordinates travel-document fraud detection across EU external borders, operating EUROSUR (European Border Surveillance System) and FADO (False and Authentic Documents Online), a multi-state database of genuine and fraudulent document images accessible to border officers across EU member states and associated countries. FRONTEX's Document and Identity Fraud unit issues the European Document Fraud Risk Analysis, an annual report classifying fraud types by document, nationality, and detection point. The document-fraud taxonomy described above derives from FRONTEX and INTERPOL classification systems.
INTERPOL's Document Fraud branch coordinates globally, maintaining the INTERPOL Stolen and Lost Travel Documents (SLTD) database (containing over 100 million records of passports and identity documents reported lost or stolen by member states) accessible in real time to border systems in 190 member countries. A passport whose chip Active Authentication fails but whose document number appears in the SLTD database provides two converging lines of forensic and intelligence evidence. INTERPOL also maintains the reference library of genuine travel-document specifications, accessible to national forensic laboratories through the I-24/7 secure network.
In India, the National Crime Records Bureau (NCRB) collates travel document fraud data under its annual Crime in India report. Passport fraud cases are investigated by the Passport Seva Kendra-linked regional passport officers in coordination with local police, with referrals to state FSLs or the CFSL for forensic examination. The Bureau of Immigration (BoI, Ministry of Home Affairs) operates the integrated Foreigners Division, which coordinates with Indian Missions abroad and with INTERPOL on suspect travel documents detected at Indian international ports.
The UK's National Document Fraud Unit (NDFU) is the specialist examination unit for identity and travel-document fraud in England and Wales, staffed by Home Office and UK Border Force document examiners. The NDFU maintains the UK's reference collection of genuine and fraudulent documents and provides expert witness services in criminal trials involving document fraud. The NDFU contributes to FRONTEX training programs and to the EU's PRADO (Public Register of Authentic travel and identity Documents Online), which provides publicly accessible sample images of genuine documents for basic officer training.
In an ICAO 9303 TD3 MRZ, the check digit over the date of birth field '850312' is calculated using weights 7, 3, 1 cycling. The digit values are 8, 5, 0, 3, 1, 2 and the weighted sum is (8x7)+(5x3)+(0x1)+(3x7)+(1x3)+(2x1) = 56+15+0+21+3+2 = 97. The check digit is:
| KINEGRAM stripe |
| Microprinting | Border, background security print | Border and laminate | Border, security design | Background guilloché |
| UV features | UV-fluorescent security inks | UV-fluorescent elements | UV-fluorescent data fields | UV-fluorescent design |
| Chip (e-Passport) | ISO 14443, BAC/PACE | ISO 14443, BAC/EAC/PACE | ISO 14443, BAC/EAC | N/A (visa label) |