Document fraud detection, explained.

What is document fraud detection?

Document fraud detection is the practice of examining a file to determine whether it has been altered, forged, or fabricated. The documents that run a business — invoices, bank statements, certificates, contracts, IDs — are trivial to edit in a modern PDF or image editor, and a changed number or swapped name looks identical to the original on screen.

Effective detection doesn't stop at "does the file open?" It reads the file the way a document examiner would: inspecting metadata, fonts, revision history, and the pixels themselves, then checking that the document's contents are internally consistent and match the real world.

Common types of document fraud

• Alteration — changing figures, dates, names, or account details on a genuine document.
• Forgery — assembling a fake document from scratch, often on copied letterhead.
• Fabrication & AI generation — synthetic statements, pay stubs, and certificates produced by software or AI.
• Malicious documents — files carrying hidden links, scripts, or macros designed to attack the reader.
• Identity & entity fraud — documents that reference companies, carriers, or people that don't check out.

How detection works: the five layers

Docurensic runs one engine over every document in five layers, each answering a different question:

• Security inspection — is the file safe? Malicious payloads, hidden links, and embedded scripts are caught first.
• Forensic analysis — has it been altered? Metadata, fonts, revision history, and pixels expose tampering.
• Reasoning — does the story hold together? An AI reads the document and explains what looks off.
• Validation — is it internally consistent? Required fields, totals, dates, and IDs are checked.
• External lookups — is it real? Companies, domains, and identifiers are corroborated against the outside world.

The layers fuse into a single 0–100 risk score and a clear Trusted / Review / Reject verdict — with the exact findings that drove it. See the engine in detail.

How to tell if a PDF was altered

A few forensic signals give an edited PDF away:

• Multiple revision markers. PDFs save edits by appending, so several %%EOF markers mean earlier versions exist.
• Impossible timestamps. A modification date earlier than the creation date is a strong tamper indicator — legitimate software rarely produces it, so it warrants review.
• Font substitution. When one line — a total, an account number — is set in a different font from the rest, it was likely replaced.
• Edited raster regions. Localized differences in a scanned image point to a doctored area.

You can inspect these yourself with the metadata lab and compare tools, or let the engine do it automatically on every scan.

Detection by document type

The checks that catch a fake differ by what the document is: a bank statement fails on arithmetic, a utility bill on identity fields, an invoice on a swapped account number. Each guide below walks one document type end to end — what gets faked, the checks that catch it in order, and a worked example.

• Fake bank statementsBalance arithmetic, typography, metadata, appended revisions and origin.
• Fake pay stubs & payslipsGross-to-net reconciliation, year-to-date drift, and employer verification.
• Fake & altered invoicesSwapped remittance details, lookalike senders, and duplicate submission.
• Fake utility billsOvertyped names, date logic, and templates reused across applicants.

The tools you need

Detecting document fraud well takes more than one check. Docurensic combines forensic scanning, document comparison, metadata and image forensics, and verification tools, plus workflows and custom rules to act on findings and an API and webhooks to plug into your systems.