When you travel by train or plane and your ticket arrives on your mobile phone, it's easy to focus only on the departure time, the carriage, and the seat. But more and more companies are using a Aztec code Instead of the typical QR code, many people wonder if a banknote is genuine or if someone could easily counterfeit it. Understanding what this code is and how it's validated helps you check your banknotes more securely and avoid unpleasant surprises at security checkpoints.
Furthermore, in Spain there is a curious situation: operators such as Renfe, Ouigo or Iryo They use the Aztec code for their banknotes, but not all of them follow the same European standards. This means that if you try to "read" the code with a generic app, you'll see somewhat understandable data in some cases (Renfe, Iryo) and a string of characters in others (Ouigo). Even so, there's a clear logic behind how these banknotes are issued and verified, and above all, there are practical ways to check if the banknote you have on your phone or printed out looks legitimate.
What is an Aztec code and how does it differ from a QR code?
The first thing is to understand what you're seeing when you look at the banknote. An Aztec code is a high-density two-dimensional codeIt's widely used in transportation (trains, planes, ID cards, etc.). In practical terms, for you it's a square image that the ticket inspector or turnstile scans to read all your travel information.
The easiest way to recognize it is to look at its characteristic visual structureThe Aztec code has a central square pattern that resembles a small “Aztec pyramid” when viewed from above. In contrast, the classic QR codes do three large squares in the corners (top left, top right and bottom left) and sometimes other smaller squares scattered throughout the interior.
This design isn't just about aesthetics: the Aztec is designed to store a lot of information in a very small spaceWith a robust error correction system (Reed-Solomon) that allows the code to continue being read even if up to 40% is damaged, smudged, or poorly printed. This is why it's so common in electronic banknotes: they can be printed small, scanned on low-quality mobile screens, and still function without issue.
How Aztec codes are used on train and plane tickets
In the transport sector, both rail and air, the Aztec code has become a A very convenient solution for mobile ticketsIt stores passenger data, route, seat, fare, security information, etc. Airlines use it in mobile boarding passes, and many European rail networks have adopted it to standardize electronic tickets.
The general operation is the same: the ticket includes a unique numeric code which is also represented in Aztec format. When you arrive at the security checkpoint (turnstiles, boarding gate, inspector on the platform), the reader scans that code and compares it with the list of valid tickets for that trip. If the code is on the list, the system marks the ticket as "used" to prevent a duplicate copy of the same ticket from being used.
In simple scenarios (a single access point, few passengers) it might be possible to validate a ticket even with a paper admissions listmanually searching for the code. But on high-speed trains, in large stations or airports, everything is done with automatic systems that scan the Aztec or QR code and validate it instantly.
Aztec code on train tickets in Spain: Renfe, Iryo, Ouigo and Adif
In Spain, the use of the Aztec code on train tickets has some interesting peculiarities. European Railway Agency (ERA) The UIC has defined standards for encoding train tickets in Aztec, so that any European operator can issue tickets that follow a common structure. However, Spain has opted for its own format, largely standardized by Adif, since it is the one that controls access in many stations.
In the Adif documentation (in the Network Statement, specifically in the section on General requirements and access conditionsA table is provided detailing how the content of the Aztec code on banknotes should be structured. This table describes public fields such as ticket number, date, time, train, car and seatand one particularly relevant field: the field 13 or operator field, reserved for whatever each company wants to add.
This means that within the same basic common scheme (defined by Adif), companies such as Renfe, Iryo or Ouigo can personalize some of the informationIn practice, when you scan a Renfe ticket with an Aztec code reader app, you can identify some data more or less clearly; in other operators, such as Ouigo, that field 13 is full of data encoded in a much more opaque way.
Real-world examples: Renfe, Iryo, and Ouigo
If you use a 2D barcode reader app on your mobile phone and scan a Renfe ticket, you'll see a long block of numbers and characters, something like this: "74275478..." followed by dates and more details. With some patience, it's possible to distinguish parts such as the ticket number, the date and time of the trip, the car and seat, the locator, and even the code for the Cercanías combinedThe rest of the content may be more difficult to interpret at first glance, but most of the fields are relatively legible.
With Iryo, the approach is similar: They don't usually use the operator field in a complex wayAnd their tickets keep field 13 empty or with simple content. Therefore, from the perspective of someone trying to understand what's in the code, Renfe and Iryo appear less "encrypted."
Ouigo's case is different. If you scan one of its Aztec codes, you'll also see an initial section with numbers pointing to public fields (ticket number, date, etc.), but suddenly a long "piece" appears that looks base64 binary contentSomething like: “IE04/s/LMy87Ort5fpyi0lMNOOpwS5IirWQupu5Zk…”. That's where the operator's famous field 13 comes into play, and it's clear that Ouigo takes advantage of it to encode internal information in a much more sophisticated way, probably for security and fraud prevention reasons.
Reverse engineering tools such as Cyber Chef Even scripts created to decrypt banknotes from other European operators (for example, Deutsche Bahn) are still used, and fully understanding what Ouigo does is not trivial. As of today, unless the company publishes that specification, it's unlikely that an end user will be able to interpret everything inside.
Aztec Code at a technical level: structure, data types and sizes
Beyond the Spanish case, the Aztec Code is defined in the standard ISO / IEC 24778 and can store a large amount of data in different formats: up to around 3.832 numeric characters, 3.067 alphanumeric characters, or about 1.914 bytes of binary data, depending on the symbol size and the level of error correction chosen.
Internally, the symbol is organized into concentric rings of modules (small black and white squares) around that central pattern. Each ring represents layers of data and error correction. The Reed-Solomon algorithm distributes redundant information so that the reader can rebuild damaged parts of the code if necessary.
The Aztec can be generated in two large size families: Compact (symbols from 15×15 to 27×27 modules) and Full range (up to approximately 151x151 modules). The central search pattern is 9x9 modules in Compact mode and 11x11 in Full Range mode, which remains constant regardless of the total code size.
Regarding data, the Aztec allows mixed encoding modesNumeric, alphanumeric, binary, and even Unicode (using UTF-8 in binary mode) are supported. This gives transport companies great flexibility in packaging complex tickets, signatures, internal identifiers, etc., always optimizing the space used according to the data type.
How are tickets validated at turnstiles and access controls?
From the traveler's point of view, validating a ticket with an Aztec code is very simple: You bring the bill close to the reader. (whether it's a turnstile, a handheld reader by the inspector, or a scanner at an airplane boarding gate) and you wait for the beep of acceptance or rejection.
On the back, what happens is much more elaborate. Each banknote includes a unique code which is printed in text, stored within the Aztec and, sometimes, also in a linear barcode or an additional QR code. When scanned, the system asks a central database if that code appears as valid for that specific train or flight, on that date and with that status (not canceled, not refunded, not already used).
If the code is valid and hasn't been used before, the system marks the ticket as "entry" and the turnstile opens or staff lets you through. This mark is key for detect duplicate banknotesIf someone has made a copy (photo, printout, forwarded screenshot) and tries to use it later, the system will detect that the code has already been scanned and reject it, indicating that it is a duplicate.
In advanced systems (such as those used for large events or concerts, which operate similarly to trains and airplanes) work is usually done in [mode name missing] onlineEach scan is checked against the server in real time. If the network fails, it can be switched to a controlled offline modeThis can be done by first downloading a list of valid codes for that event or route and working with it locally. In such cases, to avoid duplicates when there are multiple entrances, you can assign ticket "ranges" to each gate or number the entrances and use fields like a letter or "G1, G2…" on the ticket to indicate which gate each traveler should enter through.
How to verify the authenticity of your train or plane ticket with Aztec code
Although only the companies' official systems can say with absolute certainty whether a ticket is valid or not, as a user you can perform a series of actions reasonable checks to ensure your ticket looks good and reduce the risk of fraud.
1. Verify the format and appearance of the Aztec code
The first thing you can check is if the ticket has the aspect that corresponds to the operator with whom you travel. In the case of trains in Spain:
- On digital tickets from Renfe, Iryo or Ouigo you will usually find the Aztec code at the top or clearly visible, sometimes accompanied by a locator and a ticket number.
- The Aztec must show the square center pattern (the “pyramid”) and be well contrasted (black on white or equivalent colors) to facilitate scanning.
If the code is visible blurry, cropped, distorted If your document has unusual colors (for example, very little contrast), you're more likely to have problems with the verification process. This doesn't necessarily mean it's fake, but it's still a good idea to bring the original PDF or a better printed copy.
2. Use a 2D barcode reader app (with precautions)
If you're curious, you can use one Aztec/QR reading app Use your mobile phone to see what appears when you scan the ticket. It's important to do this with certain precautions: it's best to use a trusted offline app, and avoid sharing the result with third parties, as it may contain personal and travel information.
When scanning a Spanish train ticket, you will usually get a long string of characters with several blocks. On many Renfe tickets and some Iryo tickets, you can recognize the ticket number, date and time, and even fields that appear to indicate carriage and seat. In Ouigo, as we mentioned, you'll typically see one block of "readable" data and another very long one similar to base64 with encoded internal data.
What you're interested in here is checking that it appears coherent information With your trip: dates that match, reasonable references, and not something obviously made up or without any pattern. You don't need to understand 100% of the content, but if the code returns something completely empty, a text message with no apparent meaning, or a very suspicious URL that has nothing to do with the company, that's a bad sign.
3. Check your ticket on the official website or app
The really useful verification isn't done so much by reading the Aztec, but by using the data printed on the banknote: locator, ticket number, associated ID/passport, etc. With Renfe, for example, you can go to the section of “My Travels” or to the ticket inquiry area by entering the locator and your ID. If the system finds the trip and displays the same information as in the PDF or Wallet code, the ticket is almost certainly authentic.
4. Check the origin of the banknote
Another key aspect for assessing authenticity is the source from which you obtained the ticketIf you bought it on the company's official website, through its app, at a recognized travel agency, or at a physical ticket office, the chances of the ticket being fake are minimal.
However, problems arise when the ticket has been given to you by a third through unofficial channelsScreenshots from WhatsApp, forwarded PDFs without an invoice, tickets bought from strangers on social media or forums, etc. In these cases, even if the Aztec code seems correct, the risk is that:
- Be a duplicate ticket (already used or that the seller will use before you).
- Has been refunded or cancelled after you paid him.
It's very high. The only way to be sure is to try to verify the ticket with the locator on the official website or call customer service before your trip.
5. Look at the combined use with Cercanías (commuter rail) or other services
Some train tickets in Spain, especially high-speed trains (AVE, Avlo, Iryo, Ouigo, etc.), include the option of Free commuter rail or combined at origin and/or destination. This service is usually encoded both on the ticket itself (text) and in the Aztec system, through specific alphanumeric codes or different fields.
With Iryo, for example, you can use the ticket to access the Cercanías (commuter rail) in various ways, depending on the season:
- At stations with code readers (Barcelona, Madrid, Malaga, San Sebastian, Seville, Valencia, Zaragoza, etc.) it is enough to locate the Aztec code in the upper left corner of the ticket and pass it directly through the Cercanías turnstile.
- At stations without a card reader, you will have to go to self-service machines or to station staff and provide the card. alphanumeric code (usually five characters) that appears marked as “Free commuter rail” or similar.
These kinds of details also help verify that your ticket is authentic: a ticket that supposedly includes Cercanías (commuter rail), but doesn't show any. additional code or referenceIf it is not recognized when trying to redeem it at the machine, it may be hiding a problem.
Valid ways to present your ticket and avoid problems at the checkpoint
In addition to verifying authenticity, it's important to know how to present the ticket correctly so that the Aztec code can be scanned without errors. Operators like Renfe accept several valid ticket formats What should be known:
- PDF received by emailYou can print it or display it directly from your mobile device. Printing it is no longer mandatory; displaying the PDF on screen is usually sufficient at turnstiles and with staff.
- Ticket by SMSYou'll receive an SMS with a link that opens a QR code or Aztec code. Just show that screen so they can scan it.
- Cash in Wallet or PassWalletWhen you buy it, you can choose to add it to Wallet (Apple) or apps like PassWallet on Android, or go to "My Trips" and request it later. It's a very convenient way to always have your travel card with you. updated Aztec code.
- Operator's own appIn the case of Renfe, the RenfeTicket app allows you to buy and save your tickets if you are registered. From the app, you can display the code ready for scanning.
- SmartwatchIf you use an Apple Watch or another compatible smartwatch and have the app or Wallet synced, you can also display the banknote from your wrist, as long as the Aztec code is visible. good size and contrast.
In all cases, the key to the control working smoothly is that the Aztec code is visible. clear, complete and a reasonable sizeIncreasing the screen brightness, avoiding screen protectors with extreme reflections or very dirty glass, and not folding the paper (if you have it printed) make a difference.
Scanning and verification: what equipment is used and how it affects safety
The authenticity of banknotes depends not only on how they are generated, but also on how they are handled. They scan and validate at the entrance.Different types of devices are used in stations and airports:
- Phone and tablet cameras with specific apps like ML Kit: very common in events, small rooms and also as support in stations, they allow you to read both Aztec and QR with the camera.
- Professional 2D scanners (laser or image): faster and more robust, can read codes from a greater distance and with worse print quality.
- Integrated turnstiles and boarding gatesThey combine a reader and validation software against a central database.
In high-volume contexts (large concerts, festivals, main stations), priority is given to systems that allow a very fast and synchronized validation across multiple access points. This way, any attempt at duplicate use is detected immediately, even if it occurs on different doors simultaneously.
When the internet connection fails, some systems work with downloaded code listsThis system relies on a "gate-code" mechanism (for example, a "G1", "G2", etc. field on the banknote) to reduce the likelihood of the same banknote passing through two different gates undetected. While not perfect, it adds an extra layer of control against basic fraud.
Aztec code security limitations and additional measures
It is important to understand that the Aztec code, by itself, It is not a foolproof security systemIt's a very robust data storage format, with high capacity and high fault tolerance, but it doesn't include encryption or strong authentication by default. In other words, if someone could recreate the correct data and generate an Aztec, the reader could interpret it as valid without additional security measures.
Therefore, companies and infrastructure managers combine the use of Aztec with other security measures:
- Internal or private fields (such as the famous field 13 on train tickets), with data encoded or digitally signed.
- Verification against a central database in real time, which checks not only the code, but also the status of the ticket (cancelled, refunded, already used, etc.).
- Integration with user authentication systems (client accounts, official apps) that they prevent free distribution of some banknotes.
For more sensitive uses (official IDs, documentation with highly private data, etc.), the Aztec is usually accompanied by digital signatures. encryption of internal data or integration with secure issuance and verification systems that go far beyond simply scanning the symbol.
If you are an end user, the best approach is not to try to "break" or decipher all of Aztec's content, but to combine common sense, verification on the official website, and caution regarding the origin of the banknoteThe control systems are designed to make fraud increasingly difficult, especially in the case of simple copies of banknotes sent by photo or PDF.
Final considerations
Ultimately, a train or plane ticket with an Aztec code is much more than a square image on your mobile phone: it's the gateway to a whole real-time validation infrastructure that cross-references your code with databases, business rules and, in the case of Spain, with specifications specific to Adif and each operator.
Understanding what you see when you look at that "little Aztec square", checking the origin of the ticket, verifying that the data matches the official app or website, and presenting the code in the correct format are the key steps to travel with peace of mind and minimize the risk of finding the barrier closed just when your train or plane is about to depart. Share this guide so that more people can learn about the topic.