Passport Verification in the Philippines: MRZ, NFC, Authentication, and What Each Layer Actually Proves

Passport verification is not a single check. A reliable verification process typically combines three layers: MRZ validation, NFC chip authentication, and physical document inspection.

Each layer answers a different question.

Does the printed passport data make sense? Is the electronic data authentic and unaltered? Does the physical document show signs of forgery or manipulation?

There is also one more question that is critical for KYC: does the passport actually belong to the person presenting it?

That distinction matters for banks, fintechs, payment providers, VASPs, and other businesses onboarding customers remotely. A passport can be genuine and cryptographically valid while still being presented by the wrong person.

What Passport Verification Actually Checks

When a business asks whether a passport is genuine, it is actually checking several different things.

First, is the printed data internally consistent? Second, does the electronic data stored on the passport chip carry a valid signature from the issuing country? Third, does the physical passport show signs of forgery, alteration, or digital manipulation? And finally, does the person presenting the passport match the identity shown on the document?

These checks should not be treated as interchangeable. Each provides a different level of assurance, and relying on only one can leave a gap in the verification process.

The Three Layers of Passport Verification

Layer	What it reads	What it proves	What it cannot prove
MRZ	Two lines of 44 characters	Internal consistency via check digits	That the document is genuine
NFC chip	Data groups on the embedded chip	Data was signed by the issuing state and is unaltered	That the chip is not a clone, without AA or CA
Visual	Physical booklet and data page	Security features present and visible signs of manipulation	That the data matches the chip

These layers work together rather than replacing one another.

ICAO guidance for ePassport validation also calls for the data read from the chip to be compared against the physical document. This cross-check is important because it helps identify discrepancies between what is printed on the passport and what is stored electronically.

For a remote KYC flow, that means a stronger verification result comes from combining the available signals rather than treating one successful check as proof that the entire passport is genuine.

Layer 1: MRZ Extraction and Check Digit Validation

Philippine passports use the TD3 format: two lines of 44 characters carrying document type, issuing state, name, passport number, nationality, date of birth, sex, expiry, and a series of check digits.

Check digits are computed with a repeating 7, 3, 1 weight pattern, and a composite digit on line two covers several fields together. A single OCR misread anywhere in those fields fails the composite check, which is what makes the MRZ self-validating in a way no other printed field is.

Our guide to the MRZ covers the field layout and the check digit arithmetic in full, including the DFA’s adoption of the two-letter “PP” document type code for regular ePassports issued from 1 March 2026, while passports carrying the older single letter “P” remain valid until they expire.

That change matters more than it first appears, and the reason belongs to the next layer.

Layer 2: NFC Chip Reading on Philippine ePassports

Philippine ePassports contain a contactless chip that follows ICAO Doc 9303 specifications. The chip stores biographical information that corresponds to the passport data page, a digital facial image, and cryptographic information used to authenticate the electronic data.

For businesses, this creates an additional source of identity evidence beyond what can be extracted from a photograph of the passport.

How the reader accesses the chip

The chip cannot simply be opened by sending a standard read request. Access is controlled through protocols designed to protect communication between the passport and the reader.

Two protocols are particularly relevant:

• PACE, or Password Authenticated Connection Establishment, is the newer access mechanism and provides stronger protection against eavesdropping.

• BAC, or Basic Access Control, is the older mechanism. It derives access keys from information contained in the MRZ.

In practice, a reader will generally attempt PACE first and fall back to BAC where PACE is unavailable or unsupported.

Why the Philippine “PP” passport code matters

This is where the MRZ and NFC layers are directly connected. Because BAC derives its access key from MRZ fields, the reader needs to parse the MRZ correctly before it can access the chip.

A verification system that is hardcoded to expect the older single-letter “P” document code can encounter a problem when processing a passport using the newer “PP” code.

The result may look like an NFC failure, but the underlying problem is actually the MRZ parser. In other words, an MRZ parsing issue can prevent the system from opening the chip in the first place.

What the NFC chip contains

The chip contains biographical information that mirrors the passport data page and a digital facial image. That facial image can provide a strong reference for 1:1 biometric verification against a live selfie. This is particularly useful in remote onboarding because the business can compare the person presenting the passport against the facial image stored electronically on the document.

Fingerprint data is different. Where fingerprint information is stored on an ePassport chip, access requires authorisation from the issuing country. Commercial verification systems should not imply that they can freely retrieve or use those fingerprints. For most commercial passport verification flows, the accessible biometric reference is the facial image.

Passive Authentication vs. Chip Authentication

Passive Authentication verifies that the Document Security Object was correctly signed by a Document Signing Certificate and that the data groups match the hashes recorded in that object. In practical terms, it proves that the electronic passport data was authenticated by the issuing country and has not been modified since issuance.

But there is an important limitation. Passive Authentication does not prove that the physical chip is the original chip issued with the passport. A copy of the chip data can potentially be transferred to another chip while preserving the same signed contents. The copied chip may therefore still pass Passive Authentication.

What Active Authentication and Chip Authentication add

Active Authentication and Chip Authentication address this limitation. These mechanisms require the chip to perform a cryptographic operation using a private key that is not exposed to the reader. A genuine chip can perform the operation correctly.

A copied set of chip contents cannot reproduce the private-key operation in the same way. Where supported, these mechanisms therefore provide additional assurance that the electronic information is not simply being presented from a cloned chip. This leads to an important distinction for KYC teams: “NFC chip read successfully” is not the same as “passport fully authenticated.”

Likewise: “Passive Authentication passed” is not the same as “clone detection passed.”

When evaluating an identity verification provider, businesses should ask exactly which NFC authentication mechanisms are supported and what each verification result actually means.

The Certificate Problem

Passive Authentication is only possible if you hold the issuing state’s certificates. The signature is verified against a Country Signing Certificate Authority certificate, and revocation status against a certificate revocation list. ICAO operates the Public Key Directory as the distribution mechanism for participating states.

Reading a certificate from the chip itself and using it to verify that same chip’s signature is circular and is not sound practice, since the certificate may have been revoked. A verification system needs an independently maintained certificate store, and where a state does not participate in the PKD, providers must obtain certificates through other arrangements.

Worth asking any vendor directly: which states’ certificates do you hold, how are they updated, and is revocation checked.

Layer 3: Visual Security Features and Document Forensics

The physical passport contains security features that neither MRZ validation nor NFC authentication can fully replace. These may include:

• Special substrate characteristics
• Optically variable features
• UV and infrared elements
• Microprinting
• Laser-engraved personalisation
• Data page construction
• Other physical security features

The challenge is that most of these features cannot be fully inspected through a standard smartphone camera. For remote onboarding, the verification system instead relies on image-level forensics to identify signs of manipulation. These can include:

• Digitally edited passport images
• Re-photographed screens
• Printed reproductions
• Altered text
• Inconsistent fonts
• Unusual spacing or alignment
• Data page anomalies

Our guide to document forgery detection covers these techniques in more detail. The practical trade-off is straightforward. Remote verification cannot reproduce every physical inspection performed by a trained document examiner. But combining document forensics with MRZ validation, NFC authentication, and biometric verification can provide a much stronger remote verification process.

Passport Verification for Philippine KYC

Philippine institutions onboard non-residents, OFW spouses, foreign investors, and expatriate employees, and a foreign passport is often the only document available.

Passports are unusually well suited to this because ICAO Doc 9303 standardises the MRZ and the chip structure across issuing states, so one verification pipeline can handle documents from many countries in a way no national ID scheme allows.

Two constraints follow. The certificate question returns, since Passive Authentication for each issuing state depends on holding that state’s certificates. And a foreign passport establishes identity but not residence or status, so valid ID policy for non-residents usually pairs it with additional documentation, and non-residents commonly fall under enhanced due diligence in any case.

Where Passport Verification Can Fail in Practice

Even a well-designed verification system can encounter failures during real-world onboarding.

1. Poor capture quality

Glare from a phone’s flash, reflections, booklet curvature, or an incorrectly cropped MRZ can prevent accurate extraction. The composite check digit is particularly useful here because it can reveal that captured data is inconsistent.

2. NFC read failures

Mobile NFC performance varies across devices. The user may move the passport during the read, position it incorrectly, or use a device with a weaker NFC antenna. A failed NFC read should therefore not automatically be treated as evidence of fraud. A better flow can fall back to other available verification signals while recording that NFC authentication was unavailable.

3. Trusting the device too much

If critical verification decisions are calculated entirely on the user’s device, the device itself becomes part of the trust boundary. Final validation and risk decisions should be performed on infrastructure controlled by the institution or its trusted verification provider.

4. Stopping at Passive Authentication

This is one of the most important technical limitations. A system can report that Passive Authentication passed while still lacking evidence that the physical chip is not a clone. The verification result needs to clearly distinguish between data authenticity and chip authenticity.

5. Verifying the passport but not the person

This is the biggest gap in document-only verification. A genuine passport can pass MRZ validation, NFC authentication, and document forensics while being presented by someone who is not the rightful holder. That is why document verification and identity verification should be treated as separate claims. Biometric comparison, combined with liveness detection, is what helps close that gap.

Frequently Asked Questions About Passport Verification

What are the main layers of passport verification?

There are three main document verification layers: MRZ extraction and check digit validation, NFC chip reading and cryptographic authentication, and visual document inspection. A separate biometric check can then confirm whether the person presenting the passport matches the document’s facial image.

Does reading the NFC chip prove that a passport is genuine?

No. NFC reading only tells you that the chip can be accessed and data can be retrieved. Passive Authentication can confirm that the electronic data was signed by the issuing country and has not been altered. It does not, by itself, prove that the physical chip is not a clone. Active Authentication or Chip Authentication can provide additional assurance against chip cloning where supported.

What is the difference between BAC and PACE?

Both are access control protocols that let a reader open the chip. PACE is the newer mechanism and provides stronger protection against eavesdropping. BAC is older and derives its key from MRZ fields. Readers generally attempt PACE first and fall back to BAC where PACE is unsupported.

Can businesses read fingerprints from a passport chip?

No. Access to fingerprint data stored on an ePassport chip requires authorisation from the issuing country, which commercial verification providers do not hold. The facial image on the chip is accessible and is what supports biometric matching.

Why does the “PP” document code matter for chip reading?

Because BAC derives its access key from MRZ fields. The DFA adopted the two-letter code “PP” for regular Philippine ePassports issued from 1 March 2026, while passports with the older “P” remain valid until expiry. A parser hardcoded for the single letter fails to derive the key and cannot open the chip at all.

What if the chip cannot be read during onboarding?

Chip read failures are common on mobile due to NFC antenna placement, document movement, and device variability, and they are not evidence of fraud. A verification flow should fall back to MRZ validation and visual forensics rather than rejecting the customer outright, while recording that the strongest layer was unavailable.

Three Layers Verify the Document. One More Verifies the Person

Run all three layers properly and you can say something strong: this passport was issued by the state it claims, its data has not been altered, and the physical document shows no signs of manipulation. If Active or Chip Authentication ran, you can add that the chip is not a clone.

None of that tells you who is holding it. Document verification and identity verification are separate claims, and the gap between them is where most remote onboarding fraud actually lives, because a stolen genuine passport passes every cryptographic check ever designed.

Verihubs eKYC supports passport verification alongside 15+ Philippine government ID types, combining MRZ extraction and validation, document forensics, and biometric liveness matching to help businesses verify both the document and the person presenting it.

Looking to add passport verification to your KYC or digital onboarding flow? Talk to the Verihubs team about passport verification for your business.