Document Verification Tools Compared: Five Categories

Most bad purchases in this market are not the result of picking the wrong vendor. They are the result of buying from the wrong category — a team that needed to know whether a bank statement had been edited buys a product that reads bank statements very accurately, and discovers eight months later that a perfectly extracted forgery is still a forgery.

The categories look similar from the outside. They all take a document, they all return a confidence number, they all demo well. What differs is the question each one is built to answer, and it is worth being blunt about that before anyone signs anything.

We sell in one of these categories. We have tried to describe the others the way their own engineers would.

Key takeaways

• Extraction accuracy and authenticity are unrelated properties. A tool can be excellent at one and blind to the other.
• Identity verification proves a person holds a genuine ID. It says nothing about the invoice attached to the email.
• Document forensics proves things about a file. It cannot confirm a fact with the issuer.
• Most real programmes need two or three categories, and the integration between them is where the value actually is.

Category 1 — Document capture and extraction (IDP)

What it is for: turning a document into structured data. Line items off an invoice, balances off a statement, fields off a form.

Representative products: Amazon Textract, Google Document AI, Microsoft Azure Document Intelligence, ABBYY, Ocrolus, Klippa and a long tail of vertical specialists.

What it proves about authenticity: essentially nothing, by design. These systems are optimised to read what is on the page as reliably as possible, including when what is on the page is false. Some now attach fraud flags alongside extraction, and those flags are worth having, but the core competency being sold is accuracy of reading.

Buy it when: your bottleneck is manual data entry. That is a real and expensive bottleneck and these tools solve it well.

The trap: assuming that because the numbers came out cleanly, the document is fine. We wrote the full argument on why reading is not verifying.

Category 2 — Identity verification (IDV / KYC)

What it is for: establishing that a specific human is who they claim, usually by checking a government ID and matching a live selfie against it.

Representative products: Jumio, Persona, Onfido (part of Entrust), Veriff, Sumsub, Socure, iProov for the liveness layer.

What it proves: that a genuine-looking identity document was presented, that its security features and template match a known specimen, and — the harder part — that a live person rather than an injected video presented it. The good ones maintain reference libraries covering thousands of document templates worldwide, which is not something you can replicate.

Buy it when: you onboard consumers or you have a regulatory KYC obligation. There is no sensible alternative.

The trap: the scope is identity documents. Once the account exists and the customer starts sending pay stubs, invoices, bank statements and certificates of insurance, IDV has nothing to say about any of them. Plenty of fraud teams discover this gap after the fact.

Category 3 — Financial-document fraud detection

What it is for: deciding whether the bank statement, pay stub, tax form or invoice a customer just uploaded has been altered or fabricated.

Representative products: Resistant AI, Inscribe, Fortiro, and the fraud modules some IDP vendors have added. This is also where we sit, alongside a broader forensic surface.

What it proves: that a document is internally consistent, structurally plausible, and consistent with the population of similar documents the vendor has seen. Strong products in this category combine file forensics with content reasoning — the totals reconcile, the dates behave, the transaction patterns look like a real account rather than a generated one.

Buy it when: you make credit, claims, hiring or payment decisions on documents supplied by the party who benefits from the decision. That conflict of interest is the whole reason the category exists.

The trap: these systems are calibrated on the document types they were built for. Feed one a document class it has never modelled and you get confident-sounding output with no basis. Ask directly which classes are modelled and which fall back to generic checks.

Category 4 — Media and image forensics

What it is for: analysing photographs and scans — insurance claim photos, damage evidence, screenshots, photographed documents.

Representative products: Amped Authenticate and similar tools in the law-enforcement world, academic and open-source implementations, the free public services, and forensic modules inside broader platforms.

What it proves: that a region of an image has a different compression, noise or resampling history from its surroundings; that content has been cloned; that the encoder fingerprint does not match the claimed camera. These are indications, and reputable tools in this category are careful to present them that way.

Buy it when: photographic evidence carries real weight in your decisions. Insurance is the obvious case.

The trap: over-reading. A bright patch in an ELA map is not a finding. Any product presenting pixel statistics as a fraud probability is misrepresenting what the mathematics supports.

Category 5 — Source verification and data corroboration

What it is for: checking claims against authoritative external records — company registries, sanctions lists, licence boards, credit and identity bureaux, carrier authority.

Representative products: the bureaux, KYB providers like Middesk and Baton, plus the free public registries that do a surprising amount of this job for nothing.

What it proves: the strongest thing available. A registry confirming a fact outranks any amount of analysis of a file that asserts it. We maintain a directory of the free ones precisely because teams underuse them.

Buy it when: you can. The limitation is coverage — huge parts of commercial life have no registry that will answer a third party.

Where the categories fail together

Three gaps show up regardless of what you buy.

Nobody looks across documents by default. The single strongest fraud signal in most portfolios is that the same template, the same producer fingerprint or the same phantom employer keeps appearing across supposedly unrelated files. Products analyse one document at a time because that is how the API is shaped. Ask any vendor how they detect a template reused across four applications, and listen for whether the answer is a real feature or a roadmap.

Everyone reports a score, and few report evidence. A number between 0 and 100 is not reviewable. If your analyst cannot see which thing on which page produced the score, they cannot overrule it, defend it to a customer, or learn from it — and after a month of unexplained scores, they will start ignoring the tool. This is our strongest opinion about the category and it is not a subtle one.

Verdict and action get merged. Whether a document appears authentic is a question about evidence. Whether to decline the application is a business decision that includes policy, exposure and appetite. Tools that collapse the two produce disputes nobody can adjudicate, because "the system said reject" stops being traceable to anything.

Five questions worth asking any vendor

1. Which document classes are actually modelled, and what happens outside that list?
2. Show me a full evidence report, not the score. What does the analyst see at 8am?
3. What is your false-positive rate on genuine documents, and how was it measured? Detection rate alone is a meaningless half of the story.
4. Can I test it on my own documents before signing, and on how many?
5. What does it do with a scan? Much of the structural evidence is gone; be sure you understand what remains.

The fourth question is the one that separates the serious conversations from the rest. Any vendor confident in their product will let you run your own material through it, and there is a whole protocol for doing that properly in testing a document-forensics tool before you buy it.

Frequently asked questions

What is the difference between document verification and identity verification?

Identity verification establishes that a person is who they claim, usually via a government ID and a liveness check. Document verification asks whether a given file is authentic and unaltered — a question that applies to invoices, statements and certificates that have nothing to do with proving identity.

Can OCR software detect fake documents?

Not as a rule. OCR and intelligent document processing are optimised to read content accurately, including false content. Some vendors have added fraud signals, but extraction accuracy and tamper detection are separate capabilities and should be evaluated separately.

Do I need more than one type of tool?

Most programmes do. A typical stack is identity verification at onboarding, document forensics on anything supplied afterwards, and registry lookups where an authoritative source exists. The integration between them usually matters more than any individual product's benchmark.

How do I compare document fraud detection vendors fairly?

Run the same set of your own documents through each — genuine ones as well as suspect ones — and compare both what they catch and what they wrongly flag. Vendor-published detection rates are measured on vendor-chosen corpora and are not comparable across products.