Document fraud, forensics, and verification workflows — practical writing from the team building the engine.
Issuer confirmation outranks every form of analysis, including ours. A directory of the free official registries — companies, sanctions, licences, education, travel documents — and the rule that stops a fake verification
Invoices, parking tickets, letters "from the bank" — QR codes turn documents into phishing delivery vehicles. How quishing works and how to handle codes you did not generate.
A tender is decided almost entirely on paperwork — certificates, accounts, references, insurance. Most of it is scored once, by someone with forty other submissions to read, and never checked again.
Almost everything that works on a fraudulent transfer works in the first day. Almost nothing works after the third. Here is the order to work in when it has already happened.
A portfolio statement is a claim about money you cannot see, issued by an institution you may not be able to contact, in a format nobody standardised. That is a lot of room to work in.
An employment verification letter is a salary claim on a letterhead. Why this document is the easiest fake in the file, and the source-check that defeats every version of it.
A recruitment scam is a document operation. There is no job, so everything the victim receives is paper — and paper produced under time pressure by someone impersonating a company they have never worked for.
Income, assets, employment, occupancy — mortgage fraud is mostly document fraud. The six file exhibits underwriters should trust least, and what each fake looks like.
A trust seal is a picture. Copying a picture takes one right-click. Yet a row of badges in a website footer still moves purchase decisions more than almost anything else on the page.
Everything a sender types can be forged. Everything the relay servers stamped on the way through cannot be rewritten after the fact — which is why the headers are where the answer lives.
Nobody fakes a payment to steal money. They fake it to buy time — long enough to collect the goods and be somewhere else when the bank tells you nothing arrived.
The most effective domain in payment fraud is not a hacked one. It is a real domain, correctly configured, that differs from your supplier's by a single character nobody reads.