Loading blog...
Document Forgery Detection: Methods, Red Flags and AI Checks
Shweta K
|
October 5, 2026
|
5 minutes read
Document forgery detection is the practice of proving a document is genuine before you act on it. It tests the document’s pixels, file data, arithmetic and outside records for signs of alteration.
For a Head of Credit Operations at an NBFC, the failure looks ordinary. A salary slip carries an edited net pay, a bank statement gains three salary credits, and a loan is disbursed against both.
Generative tools now make a convincing fake a five-minute job. KlearStack runs compliance checks on every document in a loan file, catches tampering as one of those checks, and logs each result for the auditor.
| Document forgery detection (definition) Document forgery detection is the process of establishing whether a document was altered, fabricated or signed by someone other than its stated author before it is relied on. It combines checks on the image, the file’s metadata, the document’s internal arithmetic and its consistency with outside records. In lending and finance, the result counts only when the check and its outcome are logged as audit evidence. |
TL;DR
- Document forgery detection proves a document is genuine before money or a decision moves on it.
- Forgery comes in four forms: alteration, counterfeiting, simulated signatures and AI-generated fakes.
- Six methods work together: visual checks, metadata, pixel forensics, arithmetic, cross-document matching and issuer verification.
- Indian lenders reported Rs 48,021 crore of fraud in FY26, 84.9% of it from advances.
- The trained eye misses perfect-looking forgeries; consistency checks catch them.
- The Four-Witness Test scores how many independent witnesses your process calls on each document.
- RBI’s 2024 fraud directions make the logged evidence as important as the catch itself.
See which forged documents last month’s loan files would have caught
Why Document Forgery Is Now a Loan-Book Problem, Not a Front-Desk Problem
Indian banks and financial institutions reported Rs 48,021 crore of fraud in FY26. According to the RBI Annual Report 2025-26, 84.9% of it came from advances.
📊 Rs 48,021 crore of bank fraud in FY26, 84.9% from advances
For a credit operations head, advances fraud usually starts as a document someone believed at login. The total includes Rs 30,199 crore of legacy cases reclassified during the year.
Source: RBI Annual Report 2025-26
Many began with an income proof or a statement nobody tested beyond a glance. The same pattern shows up in how lenders spot a fake bank statement: the edit is small, and the review is fast.
Document AI that Eliminates Manual Processing and Compliance Gaps
Three Types of Forgery, and the One That Is New in 2026
Forged documents traditionally fall into three types. A fourth now matters just as much to a Chief Compliance Officer, because it leaves no original to compare against.
- Alteration. A genuine document with one field changed, such as the net pay on a salary slip or a cheque amount.
- Counterfeiting. A full replica of a real document type, such as a fake bank statement built on a bank’s template.
- Simulation. A copied signature or seal, the core of signature forgery on cheques and agreements.
- AI-generated fabrication. A document made from scratch by a generative tool, with no editing traces to find.
Our document forgery glossary entry separates forgery from wider document fraud. The fourth type breaks the old detection playbook, because pixel forensics looks for edits and a fabricated file has none.
How to Detect Forged Documents: Six Methods That Work
The direct answer to how to detect forged documents is to test them on several independent layers at once. A Head of Internal Audit should expect each of these document forgery detection methods to catch a different forger.
1. Visual and physical inspection. Fonts, alignment, logos and spacing, plus UV ink and holograms on physical IDs.
2. Metadata and file structure. Creation software, modification dates and incremental PDF saves that contradict the document’s story.
3. Pixel and compression forensics. Error level analysis exposes spliced regions and overwritten values; see how automated tampering detection works.
4. Arithmetic and cross-field logic. Running balances, gross-to-net pay, tax deductions and totals must reconcile inside the document.
5. Cross-document consistency. The salary on the slip should match the credits on the statement and the income in the ITR.
6. Issuer and record verification. The bank, employer or registry confirms the document independently of the contact details printed on it.
What we see across loan desks is consistent. Forgers fix the visible number carefully and forget the running balance underneath it. Method four catches more altered statements than method one ever will.
Cheques show why layered checks matter. The 2026 AFP Payments Fraud and Control Survey found 58% of US organisations hit by cheque fraud in 2025. Only 17% used AI to fight payments fraud.
Red Flags of a Forged Document, by Document Type
Knowing how to identify fake documents starts with accepting that red flags are document-specific, which is why one checklist fails a credit team. The table maps what a credit analyst should look for and what confirms it.
| Document | Red flags | What confirms it |
| Bank statement | Round salary credits, balances that do not carry forward, mixed fonts in one column | Recomputed running balance, PDF save history |
| Salary slip | Net pay that does not follow from gross and deductions, missing employer PAN or TAN | Arithmetic check, match to statement credits and Form 16 |
| Cheque | Amount in words and figures that differ, ink or pixel changes in the amount field | Words-to-figures check, pixel forensics, signature specimen |
| KYC document | Photo edges that do not blend, wrong font for the issuer, details that differ across IDs | Cross-document match, issuer verification |
| Invoice | New bank details, broken invoice number sequence, tax totals that do not add up | GST record check, vendor master match |
Invoice warning signs get fuller treatment in our fake invoice detection guide.
Document AI that Eliminates Manual Processing and Compliance Gaps
The Myth of the Trained Eye: Why Perfect-Looking Forgeries Get Through
The assumption is that forgery detection is a visual skill, solved by training reviewers to spot bad fonts and blurry logos. The reality is that the forgeries that cost money look perfect, and only consistency checks catch them.
| ⚠️ Warning A document that passes visual review has only passed the one test a forger prepares for. AI-generated statements and payslips now arrive with clean fonts, correct logos and no editing traces at all. |
Internal audit already knows this. In an IIA and AuditBoard survey of 373 audit leaders, 65% named fabricated invoices or financial documents a top risk. Only four in ten said they were prepared to detect AI-enabled fraud.
The pattern across audit cycles is just as telling. Flags get raised, but nobody can show who cleared them or why. A reviewed document is not a checked document, and a checked document proves nothing unless the check was logged.
AI-made fakes, including deepfake trade documents, make that gap expensive.
The Four-Witness Test: A 5-Minute Diagnostic for Your Loan Desk
Every document has four independent witnesses, and a forger has to fool all of them at once. Faking one is cheap; faking four is hard. A Head of Credit Operations can score a desk in five minutes by asking which witnesses it actually calls.
- The Pixels. Does anyone test the image for splices, erasures or overwritten fields?
- The File. Does anyone read the metadata and save history?
- The Math. Does anyone recompute balances, totals and gross-to-net pay?
- The Outside World. Does anyone match the document to other documents and to the issuer’s own records?
Score one point per witness called on every document, not on a sample. Most desks score one, because the eye covers only the Pixels, and loosely. Four, with each answer logged, is the target.
How AI Spots Altered Documents, and Where People Still Decide
Yes, AI can detect fake documents, by calling all four witnesses on every file rather than a sample. The advantage is coverage and consistency, not a magic eye.
KlearStack does this in the Loan Document Compliance lane, where the Loan KYC Agent handles the KYC pack. The platform runs pixel-level and compression checks, cross-field checks that flag impossible balances, and duplicate detection for renamed or rescanned resubmissions. Cheques get the deepest pass, with up to 10 forensic checks per cheque, and every result lands in a field-level audit trail.
KlearStack takes the drudgery; your team keeps the judgment and the final decision, and spends its time on the flagged files that need it. Flagged documents route to a named reviewer, which is also what RBI’s maker-checker expectations require. Our explainer on how AI verifies a document is real covers the model side.
💡 Tip for credit operations teams
Pilot on last month’s disbursed files, not on test samples. Real files show you which forgeries already got through and which checks your desk never runs.
Book a 30-minute pilot that checks your own KYC packs for tampering
KlearStack is not an identity-verification vendor, so live selfie matching and passport chip reads belong to an IDV tool. Physical features such as UV ink also need a scanner at the counter.
What RBI Expects After the Catch: Evidence, Not Just a Flag
The RBI Master Directions on Fraud Risk Management of 15 July 2024 strengthened the early warning signals framework for banks, NBFCs and HFCs. When a loan later turns fraudulent, the Chief Compliance Officer will be asked who checked the documents, against what, and when.
Take an NBFC disbursing 3,000 loans a month with eight documents per file: 24,000 documents. A concurrent auditor sampling 10% re-examines 2,400. That leaves 21,600 documents a month whose only check was a first glance, with no record of what that glance covered.
| Reviewed by eye | Checked and proven | |
| What is examined | Whatever the reviewer notices | Pixels, file data, arithmetic and outside records |
| Coverage | First reviewer, then a 10% audit sample | Every document in the population |
| Evidence | A tick, an initial, maybe an email | A logged result per check, with the field and reason |
| Flag handling | Often cleared without a note | Routed to a named person who records the decision |
| What the auditor gets | Your word | A trail they can replay document by document |
Before you shortlist tools, compare how each one logs its evidence, not just what it detects. Our review of document fraud detection software for banks sets the vendors side by side.
FAQs
What evidence is needed to prove forgery?
Proving forgery usually needs the questioned document, a genuine comparison sample such as the issuer’s original, and an expert or forensic report showing where they differ. Inside a lender, the internal evidence is a record of each check run, its result and who reviewed the flag. Evidence captured at the time carries more weight than evidence reconstructed later.
What is the punishment for document forgery?
In India, forgery is an offence under Section 336 of the Bharatiya Nyaya Sanhita, 2023, punishable with up to two years’ imprisonment, a fine or both. Forgery intended for cheating carries up to seven years and a fine. Section 340 punishes knowingly using a forged document as genuine in the same way as forging it, and penalties differ in other countries.
How to check if a signature is forged?
Compare the questioned signature with several known genuine samples, looking at stroke flow, pressure, pen lifts and proportions rather than overall shape. Forged signatures often show hesitation marks, blunt starts and uneven line quality from slow copying. For cheques and other high-value instruments, automated checks against the approved specimen can flag mismatches for a person to review.
How to identify real documents?
A real document stays consistent across every layer: its image, its file data, its own arithmetic and the records of whoever issued it. Confirm it with the issuer directly, such as the bank, employer or tax portal, rather than using contact details printed on the document. If any one layer disagrees, treat the document as unverified until the difference is explained.
Shweta K
Shweta K is a Technical Content Strategist with expertise in B2B SaaS content, governance, risk and compliance (GRC), and technical writing for compliance-heavy industries. At KlearStack, she focuses on translating complex capabilities in intelligent document processing, fraud detection, audit trails, and regulatory compliance into clear, audience-focused content. That content reaches enterprise and BFSI buyers, including compliance teams and internal audit leaders, at the right stage of their journey. Her approach combines market and competitive research, content strategy, and precise technical writing to build authority, make GRC and compliance topics easy to act on, and drive qualified engagement.