How to Verify a QR Code or Barcode on Official Documents

Verifying a QR code or barcode on an official document means checking not just that it scans, but what it actually proves: a cryptographic signature tied to the issuer, or merely a convenience encoding of printed text. A scannable code is not automatic evidence of authenticity — France's 2D-Doc and the EU Digital Identity Wallet are cryptographically signed, while most driving licence barcodes simply repeat visible data and can be regenerated with the right software. This guide explains how to tell the difference.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.

---

What Does a QR Code or Barcode on a Document Actually Prove

A QR code or barcode proves only what its payload contains — nothing more. Two documents can look identical at a glance, one carrying a code that cryptographically signs the printed content and one that merely stores a copy of the same text, and a scanning app will happily open both. The real question is not "does it scan" but what data model sits behind the scan.

Three models exist in practice: a plain data carrier stores a copy of printed fields with no cryptographic link to an issuer; a verification-URL carrier points to a web page that checks the document against a live database; a cryptographically signed carrier contains a digital signature, generated with the issuer's private key, verifiable offline against a public key. France's 2D-Doc standard, specified by ANTS in its cahier des charges v3.3.4 of 17 June 2024, is the clearest large-scale example of the signed model, used on over 50 official French document types since income tax notices adopted it in April 2022 (ANTS 2D-Doc specification).

Is a Scannable QR Code Proof That a Document Is Genuine

A scannable QR code is not proof of genuineness, because a fraudster can encode whatever payload they choose and print it onto a forged document. What matters is whether the decoded content can be checked against a source the fraudster does not control. Users on mortgage and lending forums often ask a version of this question directly — threads discussing payslip checks return repeatedly to whether a QR code "actually proves anything or if someone could just print any code on there." It depends entirely on the format.

A code built on a plain data-carrier model, like most driving licence PDF417 barcodes, only demonstrates internal consistency, not authenticity. A related question that surfaces in identity-verification forums is whether a barcode that decodes cleanly back to the printed details means the card itself is genuine — it does not. AAMVA-format PDF417 barcodes on North American licences hold roughly 1,100 bytes of data, typically the same name, date of birth, and address already printed on the card, with no cryptographic link to the issuer. A verifier scanning it is cross-checking OCR'd printed text against barcode text; if a forger edits both consistently, the barcode "matches" a document that is entirely fake.

How Does France's 2D-Doc Standard Prove Document Authenticity

France's 2D-Doc proves authenticity because its Datamatrix code embeds an asymmetric cryptographic signature computed by the issuing authority, not merely a copy of the printed fields. The 2D-Doc cahier des charges (v3.3.4, published 17 June 2024 by France Titres) defines a signed payload structure covering identity documents, tax notices, and utility bills, verifiable offline by any reader holding the relevant public key certificate (ANTS technical specification, PDF). A verifier decodes the Datamatrix, extracts the signed data block and signature, and confirms mathematically that the data has not changed since it was signed.

A French avis d'imposition, mandatory since April 2022, cannot be forged by editing the visible numbers alone, because the signature would no longer validate. For a UK verifier handling French documents in a KYC flow, scanning confirms the code decodes — only signature verification against the correct public key confirms the document is genuine.

What Is the MRZ and How Does It Detect Forged Passports

The Machine Readable Zone (MRZ) is the two-line OCR-B text block at the base of a passport or ID card photo page, structured under ICAO Doc 9303 so every field carries an algorithmically computed check digit. If a fraudster alters a date of birth, document number, or expiry date without correctly recalculating the check digit, the mismatch is detectable by any reader running the ICAO algorithm, offline.

A mismatch between printed visual data and MRZ-derived data, or between the MRZ and its own check digits, is an automatically detectable forgery signal defined by ICAO 9303. The MRZ is not a barcode at all, but its self-checking arithmetic gives it built-in consistency verification plain barcodes lack, even without a full cryptographic signature. See our guide to fake passport fraud detection for more.

Comparing QR and Barcode Verification Standards

No two code standards prove the same thing, and mixing up their guarantees is a common verification mistake. The table below sets out what each standard actually proves, and its limitation in isolation.

Under eIDAS 2, all 27 EU member states must offer citizens a digital identity wallet by December 2026, with financial institutions expected to accept wallet credentials within 36 months of the implementing acts entering into force, targeting December 2027. Its QR codes enable cross-device authentication, but the trust anchor is the underlying credential, not the QR image — closer to 2D-Doc than to a static barcode. Our eIDAS 2 wallet guide covers the rollout timeline.

What Is the UK's Equivalent to a Signed Document QR Code

The UK does not yet have a nationwide cryptographically signed document standard comparable to 2D-Doc, though a framework is now in place. The UK Digital Verification Services (DVS) trust framework, under the Data (Use and Access) Act 2025, has version 1.0 coming into force no earlier than 1 September 2026, requiring certified providers to meet standards on data protection, access control, and incident management (GOV.UK: DVS trust framework 1.0). GOV.UK One Login and the emerging GOV.UK Wallet are the government's routes for citizens to hold digital credentials instead of paper, moving toward checking a live, certified credential rather than a static printed code.

Identity fraud is the UK's most common recorded fraud type, with over 240,000 cases filed to the National Fraud Database in 2025, and criminals increasingly use AI to produce convincing fake documents at scale (BiometricUpdate: GOV.UK ahead of mDL rollout). Until DVS and GOV.UK Wallet are fully operational, most UK paper and PDF documents carry no code at all, or a plain data-carrier code rather than a signature, which is why cross-checking the surrounding document remains necessary.

Can Someone Fake a QR Code on a Payslip or Bank Document

Yes — a QR code on a payslip or bank document can be faked whenever it is a plain data carrier or points to a website the fraudster also controls. A convincing forgery only needs a QR image with plausible text, or a lookalike domain, neither requiring specialist skill. This is also why quishing — a fraudulent sticker placed over a legitimate code — is a recognised UK fraud pattern on parking machines and official-looking mail, flagged by UK police forces and Action Fraud as related to, but distinct from, document forgery.

Only a verification flow that checks whether the destination domain matches the genuine issuer, whether the payload format matches known genuine samples, and whether the surrounding document is internally consistent gives a defensible answer. Our guide to detecting fake driving licences covers a parallel case where barcode data alone is insufficient.

How to Manually Check a QR Code or Barcode for Signs of Forgery

Inspect the code's physical placement before scanning: a sticker overlay, visible misalignment, or a resolution mismatch with surrounding print are common signs a genuine code has been covered or replaced. Codes printed by an issuer's production system sit flush with the page layout; a code added later often does not.

Decode with a scanner that displays the raw payload or destination URL before opening it. Check that any URL uses HTTPS and a domain matching the known issuer — a shortened link or unfamiliar domain is a red flag consistent with the quishing pattern UK authorities have documented. Where the payload is data, cross-check every decoded field against the printed text; any mismatch is worth escalating. A 2D-Doc should be verifiable through a compliant reader that checks the signature, not just decodes text, while a PDF417 only ever confirms internal consistency — the wrong code format for a claimed issuer is itself a fraud signal.

Why Code Verification Is One Layer, Not the Whole Answer

QR and barcode verification catches a meaningful share of low-effort forgeries, but it is blind to anything outside the code — a forgery that edits printed text and payload consistently passes a barcode-only check every time. This mirrors the broader pattern in fraud detection: according to the ACFE 2024 Report to the Nations, manual fraud detection methods catch only 37% of cases, with an average detection delay of 87 days, underscoring why single-signal checks alone are insufficient.

Our platform applies multi-layer analysis — structural, metadata, and cross-document consistency — rather than treating a scannable code as proof on its own, checking code format and payload alongside document layout, field consistency, and metadata across the 3,200+ document types and 32 jurisdictions CheckFile supports. No single check should be the sole basis for an accept or reject decision in a regulated workflow such as banking KYC onboarding, a principle set out further in our document verification guide.

Barcode and QR analysis also says nothing about whether a document was generated wholesale by AI rather than edited from a genuine template, a separate and growing risk. CheckFile's structural and code-level checks complement, rather than replace, deeper forensic and AI-generation detection: our AI and deepfake document detection routes to CheckFile's forensic partner Label4 for that layer, and no solution, including this one, claims to detect every forgery. More on how these layers fit into overall security is on our security page; current plans are on the pricing page.

Frequently Asked Questions

Does a QR code on a document always mean it is genuine

No. A plain data-carrier code can be freely recreated by a forger, while a signed code like France's 2D-Doc can be independently verified against the issuer's public key. Check which model the document type is supposed to use before treating a scan as reassurance.

What is the difference between a barcode that stores data and one that carries a digital signature

A data-storing barcode, such as most PDF417 codes on driving licences, repeats printed fields with no cryptographic link to the issuer. A signature-carrying code, such as France's 2D-Doc, embeds a signature a reader can validate offline against the issuer's public key.

Can the MRZ on a passport be forged without detection

ICAO 9303's check-digit algorithm makes altered MRZ data detectable when it does not match its check digit, but the MRZ is not a full signature. A forger who correctly recalculates every digit can still pass an MRZ-only check, so passport verification also relies on physical security features and chip-based checks.

Is the UK planning a signed QR code standard like France's 2D-Doc

The UK's DVS trust framework, version 1.0, comes into force no earlier than 1 September 2026 under the Data (Use and Access) Act 2025, alongside GOV.UK One Login and the developing GOV.UK Wallet. These set certification standards for credential providers, though a nationwide signed-code standard comparable to 2D-Doc is not yet in place.

Should a business rely on QR code scanning alone to accept a document

No. A defensible process treats a scan as one input among several, alongside layout consistency, metadata inspection, and cross-field checks, because a scan alone cannot distinguish a signed code from a freely recreated one. Regulated firms should document a multi-signal process rather than a single scan-based gate.

---

This article is provided for informational purposes and does not constitute legal or regulatory advice. Always refer to the relevant regulator or issuing authority for definitive guidance on a specific document type.