Document Tampering Detection: How to Spot Manipulated Documents

Document tampering detection is the process of checking whether a document was changed after it was issued. It combines visual inspection, file forensics, data cross-checks and automated models to catch edited numbers, swapped photos, altered dates and rebuilt templates.

Anyone who has reviewed loan files knows the uncomfortable part. The tampered document usually looks fine. The font is right, the logo is right, and the salary slip even smells like it came from HR. The edit is one number, or one date, or one name.

This guide walks through how tampering shows up, where to look, and where human review runs out of road.

Tampered, forged, fabricated: they aren’t the same

The terms get used interchangeably, but the detection approach differs.

A tampered document started as a genuine one. Someone changed a balance, a date of birth or an employer name. A forged document imitates an issuer’s format without ever being issued by them. A fabricated document has no real-world counterpart at all, such as a salary slip for a job that doesn’t exist.

Tampering is the hardest of the three to catch, because most of the document is real. Fraudsters know this. Nudging ₹38,000 to ₹68,000 draws far less attention than inventing a whole payslip.

Layer one: what you can see

Start with the basics. They still catch a surprising share of edits.

• Font mismatches. Look closely at digits. An edited amount often uses a slightly different weight, spacing or kerning than the numbers around it.
• Alignment drift. Numbers in a right-aligned column that sit a pixel off, or text that doesn’t share a baseline with its neighbours.
• Background artefacts. Patches of a slightly different colour behind edited text, or a stamp or watermark that gets cut off.
• Photo problems. A pasted ID photo often has different sharpness, lighting or compression from the rest of the card.
• Impossible details. A payslip dated on a bank holiday, a statement whose page count doesn’t match the footer, an address with a pincode that doesn’t belong to the city.

Visual checks work best as a first filter. A skilled editor using modern tools can defeat them in minutes, so treat a clean-looking document as untested, not verified.

Layer two: what’s inside the file

Every digital file carries information the sender didn’t think about.

Metadata. PDFs record a Producer, a Creator, a creation date and a modification date. A bank statement that claims to be system-generated but lists a consumer photo editor as its producer deserves a second look. So does one whose modification date falls weeks after the statement period ended. Metadata can be scrubbed, so a clean result proves little. A suspicious one is a strong signal.

Edit history. Some PDFs are saved with incremental updates, which means earlier versions of the content may still sit inside the file. Multiple revisions in a document that should have been generated once by a bank’s system are a red flag.

Font structure. Genuine system-generated documents usually embed a small, consistent set of fonts. If a single amount uses a different embedded font subset from the rest of the page, that number probably came from somewhere else.

Image forensics. For scans and photos, error level analysis and compression inconsistencies can show that one region was saved at a different quality from the rest. It isn’t proof on its own, and it throws false positives on heavily compressed phone photos, so it works best as one signal among several.

Screenshots and re-scans. Fraudsters often send a photo of a screen, or print and re-scan, precisely to wipe out the file trail. A flow that accepts only originally issued files, or pulls documents directly from the source, closes much of this gap.

Layer three: does the content add up

Many good detections have nothing to do with pixels. They come from asking whether the document agrees with itself and with everything around it.

• Arithmetic. Do running balances reconcile line by line? Does gross minus deductions equal net pay? Edited statements often break the math in a place nobody thought to fix.
• Check digits. Some identifiers carry built-in validation. Aadhaar numbers use the Verhoeff checksum, and GSTINs include a check character, so a mistyped or invented number can fail before you spend a single API call.
• Cross-document consistency. Does the salary credit on the bank statement match the payslip? Do the employer name and PAN on Form 16 line up with the employment record? A tampered document tends to contradict its neighbours.
• Behavioural sense. A round-figure salary credited on the wrong day each month, or one unusually large deposit just before an application, tells a story.
• Source verification. The strongest check is going back to the issuer. For Indian identity and address documents, a consent-based pull through DigiLocker returns the document from its source, which sidesteps the question of whether an uploaded copy was edited.

Why manual review stops scaling

A trained reviewer can catch a lot. The trouble is volume, fatigue and the quality of the fakes. Generative tools now produce clean layouts, consistent fonts and plausible transaction narratives without the usual clumsy tells. Reviewers also can’t open every file’s internals, and they can’t compare an incoming application against every earlier one to see the same template reused under different names.

Speed adds pressure too. Digital onboarding depends on instant decisions, and a thorough manual review is the opposite of instant.

What automated document tampering detection does

Automated systems run many of the checks above at once and return a risk assessment rather than a hunch. A reasonable setup covers:

1. File-level analysis of metadata, structure, fonts and edit traces.
2. Visual analysis of pixel-level inconsistencies, pasted regions and template deviations.
3. Content validation of arithmetic, formats, check digits and internal consistency.
4. Cross-referencing against source data and other submitted documents.
5. Scoring and explanation, so a human reviewer sees why a file was flagged and not just that it was.

Gridlines offers GenAI-powered document tamper detection as part of its verification stack, alongside identity checks and risk signals across onboarding journeys. Teams typically plug this into an API step early in the flow, so suspicious files get routed to a reviewer before they reach underwriting.

One practical point: no detector should be the sole decision-maker. Use tamper signals to prioritise review, and keep a human in the loop for borderline cases.

A simple checklist to start with

• Prefer originals pulled from the source over uploaded copies.
• Reject screenshots where a native file is available.
• Check metadata and modification dates on every PDF.
• Reconcile the numbers, then reconcile them against a second document.
• Validate identifiers before making downstream calls.
• Log why each document passed or failed, for audit purposes.

Frequently asked questions

Can you detect a tampered PDF just by looking at it?
Sometimes, but not reliably. Visual checks catch clumsy edits. Careful ones need metadata, structure and content analysis.

Does clean metadata mean a document is genuine?
No. Metadata can be stripped or rewritten. It’s a useful signal, not a verdict.

What are the most commonly tampered documents in lending?
Salary slips, bank statements, utility bills and ID proofs, because they directly affect income, address and identity decisions.

Is automated detection enough by itself?
It’s best treated as a strong filter that focuses human attention, not a replacement for it.