MRZ, OCR and NFC — what is the difference?
A comparison of the three ways to read an identity document — visual OCR, MRZ parsing and NFC chip reading — covering what each one actually proves and when each is enough.
“Document reading” can mean three different technologies, and the difference between them decides how much security you actually have. All three return the same fields. What differs is their evidential value.
OCR: reads what is printed
Optical character recognition turns text in a photo of the card into strings. Name, document number, date of birth — all lifted from the visual zone.
- What does it prove? Nothing. Only that this text appeared in front of a camera.
- Where is it useful? Speeding up form filling and improving the user experience.
- Weakness? An edited image of a card is indistinguishable from a real one as far as OCR is concerned.
OCR on its own is not identity verification. It is data entry automation.
MRZ: a strip designed for machines
The Machine Readable Zone is the fixed-width block of two or three lines padded with < characters along the bottom of the document, formatted to ICAO 9303.
Two things separate MRZ from plain OCR:
A fixed format. Every character has a known position, which raises read accuracy far above free text.
Check digits. The MRZ carries check digits for the document number, date of birth and expiry date individually, plus a composite one over the whole block. They are computed with a simple weighted sum (the 7-3-1 cycle).
If a check digit does not match, one of two things is true: either the read was wrong, or the data was altered by hand. Neither is a reason to continue.
- What does it prove? That the data is internally consistent. Not that the document is genuine.
- Its real job? Producing the access key needed to open the NFC chip.
That last point is often missed: the key to the chip is derived from the MRZ. This is why reading the back of the card is a precondition for the NFC step.
NFC: reads the chip and verifies the signature
The contactless chip carries the same details digitally — this time signed by the authority that issued the document.
Data read from the chip is checked against the hashes in the Document Security Object (SOD), and the SOD signature is verified up the country’s certificate chain. Pass that and you hold cryptographic proof.
- What does it prove? That the data came from a genuine state-issued document and was not altered.
- Bonus? The high-resolution biometric photo in DG2, far better for face matching than the printed image.
- Weakness? Unavailable on documents without a chip; needs device support and some user dexterity.
Side by side
| OCR | MRZ | NFC | |
|---|---|---|---|
| Source | Visual zone | Machine strip | Contactless chip |
| Read accuracy | Medium | High | Exact |
| Internal consistency | None | Check digits | Hash verification |
| Cryptographic proof | No | No | Yes |
| Biometric photo | Low resolution | None | High resolution |
| Resistance to forgery | Low | Low | High |
When is each enough?
OCR alone can be enough: where you are not establishing identity at all, only speeding up data entry — filling an address on a shipping form, for instance.
OCR + MRZ can be enough: low-risk actions where internal consistency is sufficient. It is still weak against a well-made forgery.
Prefer NFC: account opening, limit upgrades, regulated application processes. In short, anywhere letting the wrong person in carries a real cost.
Note the wording. The regulatory framework in Türkiye does not treat the chip as the only accepted route; it sets up a tiered structure. The photo is taken from the contactless chip where that is possible, and where it is not, the flow falls back to the printed photo plus verification of the document’s visual security features.
This is decisive for flow design: a product that simply stops when the chip will not read and one that genuinely implements the fallback differ sharply in real-world completion rate. The question for a vendor is a simple one: what does the flow do when the chip does not respond?
How the three work together
A healthy flow uses all three and feeds each result into verifying the next:
- Front side — OCR. Read the visual fields, recognise the document type and layout.
- Back side — MRZ. Parse the strip and verify the check digits.
- Cross-check. Compare the name and number from OCR against the MRZ values. A mismatch is a strong signal the card has been tampered with.
- NFC. Open the chip with the key derived from the MRZ, read DG1 and DG2, run passive authentication.
- Final cross-check. DG1 from the chip must match the MRZ exactly. If it does not, the document is fake.
The cross-checks at steps three and five catch manipulations that no single method finds on its own. Whether a vendor performs them is a question worth asking.
Common questions
- What is an MRZ?
- The Machine Readable Zone is the fixed-format block padded with angle brackets along the bottom of ID cards and passports. It follows ICAO 9303, and its check digits let you detect a misread or altered data.
- What is the difference between OCR and NFC?
- OCR turns text in a photo of the document into strings and proves nothing about whether the document is genuine. NFC reads the contactless chip, and that data arrives signed by the authority that issued the card. OCR speeds up data entry; NFC proves authenticity.
- Can identity be verified with OCR alone?
- It is enough where you are not establishing identity at all and only want faster data entry. It is not enough anywhere letting the wrong person in carries a real cost, because an edited image of a card is indistinguishable from a real one as far as OCR is concerned.
- What happens if the chip cannot be read?
- The flow should not stop. When the chip does not respond, it falls back to verifying the document's visual security features and continues. A product that stops and one that implements the fallback differ sharply in real-world completion rate.