Document Forgery Detection: Methods, Red Flags and AI Checks

Document forgery detection is the practice of proving a document is genuine before you act on it. It tests the document’s pixels, file data, arithmetic and outside records for signs of alteration.

For a Head of Credit Operations at an NBFC, the failure looks ordinary. A salary slip carries an edited net pay, a bank statement gains three salary credits, and a loan is disbursed against both.

Generative tools now make a convincing fake a five-minute job. KlearStack runs compliance checks on every document in a loan file, catches tampering as one of those checks, and logs each result for the auditor.

TL;DR

1. Document forgery detection proves a document is genuine before money or a decision moves on it.
2. Forgery comes in four forms: alteration, counterfeiting, simulated signatures and AI-generated fakes.
3. Six methods work together: visual checks, metadata, pixel forensics, arithmetic, cross-document matching and issuer verification.
4. Indian lenders reported Rs 48,021 crore of fraud in FY26, 84.9% of it from advances.
5. The trained eye misses perfect-looking forgeries; consistency checks catch them.
6. The Four-Witness Test scores how many independent witnesses your process calls on each document.
7. RBI’s 2024 fraud directions make the logged evidence as important as the catch itself.

See which forged documents last month’s loan files would have caught

Why Document Forgery Is Now a Loan-Book Problem, Not a Front-Desk Problem

Indian banks and financial institutions reported Rs 48,021 crore of fraud in FY26. According to the RBI Annual Report 2025-26, 84.9% of it came from advances.

📊 Rs 48,021 crore of bank fraud in FY26, 84.9% from advances

For a credit operations head, advances fraud usually starts as a document someone believed at login. The total includes Rs 30,199 crore of legacy cases reclassified during the year.

Source: RBI Annual Report 2025-26

Many began with an income proof or a statement nobody tested beyond a glance. The same pattern shows up in how lenders spot a fake bank statement: the edit is small, and the review is fast.

Types of Forgery, and the One That Is New in 2026

Forged documents traditionally fall into three types. A fourth now matters just as much to a Chief Compliance Officer, because it leaves no original to compare against.

• Alteration. A genuine document with one field changed, such as the net pay on a salary slip or a cheque amount.
• Counterfeiting. A full replica of a real document type, such as a fake bank statement built on a bank’s template.
• Simulation. A copied signature or seal, the core of signature forgery on cheques and agreements.
• AI-generated fabrication. A document made from scratch by a generative tool, with no editing traces to find.

Our document forgery glossary entry separates forgery from wider document fraud. The fourth type breaks the old detection playbook, because pixel forensics looks for edits and a fabricated file has none.

How to Detect Forged Documents: Six Methods That Work

The direct answer to how to detect forged documents is to test them on several independent layers at once. A Head of Internal Audit should expect each of these document forgery detection methods to catch a different forger.

1. Visual and physical inspection. Fonts, alignment, logos and spacing, plus UV ink and holograms on physical IDs.

2. Metadata and file structure. Creation software, modification dates and incremental PDF saves that contradict the document’s story.

3. Pixel and compression forensics. Error level analysis exposes spliced regions and overwritten values; see how automated tampering detection works.

4. Arithmetic and cross-field logic. Running balances, gross-to-net pay, tax deductions and totals must reconcile inside the document.

5. Cross-document consistency. The salary on the slip should match the credits on the statement and the income in the ITR.

6. Issuer and record verification. The bank, employer or registry confirms the document independently of the contact details printed on it.

What we see across loan desks is consistent. Forgers fix the visible number carefully and forget the running balance underneath it. Method four catches more altered statements than method one ever will.

Cheques show why layered checks matter. The 2026 AFP Payments Fraud and Control Survey found 58% of US organisations hit by cheque fraud in 2025. Only 17% used AI to fight payments fraud.

Red Flags of a Forged Document, by Document Type

Knowing how to identify fake documents starts with accepting that red flags are document-specific, which is why one checklist fails a credit team. The table maps what a credit analyst should look for and what confirms it.

Invoice warning signs get fuller treatment in our fake invoice detection guide.

The Myth of the Trained Eye: Why Perfect-Looking Forgeries Get Through

The assumption is that forgery detection is a visual skill, solved by training reviewers to spot bad fonts and blurry logos. The reality is that the forgeries that cost money look perfect, and only consistency checks catch them.

Internal audit already knows this. In an IIA and AuditBoard survey of 373 audit leaders, 65% named fabricated invoices or financial documents a top risk. Only four in ten said they were prepared to detect AI-enabled fraud.

The pattern across audit cycles is just as telling. Flags get raised, but nobody can show who cleared them or why. A reviewed document is not a checked document, and a checked document proves nothing unless the check was logged.

AI-made fakes, including deepfake trade documents, make that gap expensive.

The Four-Witness Test: A 5-Minute Diagnostic for Your Loan Desk

Every document has four independent witnesses, and a forger has to fool all of them at once. Faking one is cheap; faking four is hard. A Head of Credit Operations can score a desk in five minutes by asking which witnesses it actually calls.

• The Pixels. Does anyone test the image for splices, erasures or overwritten fields?
• The File. Does anyone read the metadata and save history?
• The Math. Does anyone recompute balances, totals and gross-to-net pay?
• The Outside World. Does anyone match the document to other documents and to the issuer’s own records?

Score one point per witness called on every document, not on a sample. Most desks score one, because the eye covers only the Pixels, and loosely. Four, with each answer logged, is the target.

How AI Spots Altered Documents, and Where People Still Decide

Yes, AI can detect fake documents, by calling all four witnesses on every file rather than a sample. The advantage is coverage and consistency, not a magic eye.

KlearStack does this in the Loan Document Compliance lane, where the Loan KYC Agent handles the KYC pack. The platform runs pixel-level and compression checks, cross-field checks that flag impossible balances, and duplicate detection for renamed or rescanned resubmissions. Cheques get the deepest pass, with up to 10 forensic checks per cheque, and every result lands in a field-level audit trail.

KlearStack takes the drudgery; your team keeps the judgment and the final decision, and spends its time on the flagged files that need it. Flagged documents route to a named reviewer, which is also what RBI’s maker-checker expectations require. Our explainer on how AI verifies a document is real covers the model side.

💡 Tip for credit operations teams

Pilot on last month’s disbursed files, not on test samples. Real files show you which forgeries already got through and which checks your desk never runs.

Related: Automated KYC verification for banking and finance

Book a 30-minute pilot that checks your own KYC packs for tampering

KlearStack is not an identity-verification vendor, so live selfie matching and passport chip reads belong to an IDV tool. Physical features such as UV ink also need a scanner at the counter.

What RBI Expects After the Catch: Evidence, Not Just a Flag

The RBI Master Directions on Fraud Risk Management of 15 July 2024 strengthened the early warning signals framework for banks, NBFCs and HFCs. When a loan later turns fraudulent, the Chief Compliance Officer will be asked who checked the documents, against what, and when.

Take an NBFC disbursing 3,000 loans a month with eight documents per file: 24,000 documents. A concurrent auditor sampling 10% re-examines 2,400. That leaves 21,600 documents a month whose only check was a first glance, with no record of what that glance covered.

Before you shortlist tools, compare how each one logs its evidence, not just what it detects. Our review of document fraud detection software for banks sets the vendors side by side.

FAQs