AI-Generated Fake Documents: What PDF Metadata Can Detect

Producing a convincing fake payslip, bank statement or invoice no longer takes design skill. A free prompt and a few minutes are enough to get a clean, well-laid-out PDF. That changes what a reviewer can trust by eye, and it changes what a file check can honestly promise. This is a dated look at where things stood in 2026: what the public sources say, what the file itself can still show, and where it shows nothing.

What the Public Sources Say in 2026

Four named sources frame the picture. None of them measures PDF forgery specifically, so treat them as context for the trend, not as a count of fake PDFs.

• Deloitte. Its Center for Financial Services predicts that generative AI could push US fraud losses to $40 billion by 2027, up from $12.3 billion in 2023 – a 32% compound annual growth rate (published 29 May 2024). It is a projection across all fraud, not only documents.
• FinCEN. Alert FIN-2024-Alert004, issued on 13 November 2024, says that since 2023 it has seen more suspicious-activity reports describing deepfake media in fraud against financial institutions, including altered or created identity documents used to get past verification.
• FBI. A public service announcement of 3 December 2024 warns that criminals use generative AI to make their schemes more believable, including fake identification documents and other fabricated images.
• Inscribe. Its 2025 Document Fraud Report found that bank statements made up 59% of the fraudulent documents in its data, and that use of fraudulent templates rose 49.8% from 2023 to 2024, which it links to easier access to AI tools. Inscribe is a vendor in this market, so read the figures as one company’s dataset.

For more figures and how each was sourced, see Document Fraud Statistics 2026.

Why Visual Review Stopped Being Enough

A forged bank statement used to mean editing a scan, matching fonts and backgrounds, and hoping nobody noticed the compression artefacts. Careful reviewers caught a meaningful share of those attempts.

A generated document is a different thing. It was never photographed, so there is no scan noise. The typography is consistent, the layout follows the conventions of the institution it imitates, and the arithmetic can be made to add up. The traditional visual tells are simply absent, and a reviewer who relies on appearance is checking the one layer the forger controls completely.

What the File Can Still Show

A PDF is a file with a history, and that history is separate from how the page looks. Where a document was assembled or changed after it was created, the file often records it. In outcome terms, these are the situations where file history helps:

• A document edited after it was issued. When a genuine statement has been altered, the file often records that it changed, whether the edit was made by hand or with an AI tool.
• Pages from different origins. A statement assembled from pages that were produced in different places.
• An origin that does not fit the claim. A file whose history does not match the kind of system that normally issues that document.
• Dates that cannot be right. A file whose own recorded timeline is impossible.
• Changes after a digital signature. If a signed document was changed after signing, that is flagged with the highest confidence.

How HTPBE? handles this topic is explained on the AI-generated document detection page, which is the product-side explanation of this topic. This article is the dated analysis; that page describes how the service behaves today.

What HTPBE? Does Not Claim

HTPBE? does not read a PDF and say ‘an AI wrote this’. It reports the fact of file edits and the file’s history, nothing about who or what authored the words. Detect AI-Generated PDFs: What Works and What Does Not covers that distinction in more detail.

The consequence matters for anyone reviewing documents. A fabricated document does not always carry evidence of a change, and the check can only report what the file shows. So an inconclusive or intact result is not proof that the content is genuine.

• intact means no sign of editing after creation. It does not certify the figures, the names or the issuer.
• inconclusive means the file was not shown to be modified, but its origin does not let the check confirm it. For a document that claims an institutional source, treat this as ‘needs source confirmation’, not as a pass.
• modified means the file shows changes after it was created. It is evidence of an edit, not a finding of fraud or intent.

The check answers one question: has this file been changed since it was made? Whether the document is what it claims to be is a different question, and it is answered outside the file.

Three Scenarios

A payslip for a rental application. The applicant sends a payslip that looks right. The file check returns inconclusive: it finds no edit, but cannot confirm the file came from a payroll system. The reviewer does not reject it and does not accept it. They ask for the employer’s verification letter or contact the employer through a number found independently, not one printed on the payslip. See also How to Spot Fake Pay Stubs and Fake Salary Slip Detection.

A bank statement in a lending file. A statement arrives with a consistent look, but the file shows it was changed after the bank issued it. The result is modified. This is the clear case: the reviewer asks the applicant for the statement downloaded directly from the bank, or retrieves it through a bank-connected source. Context on this document type is in How to Spot a Fake Bank Statement.

An invoice from a regular supplier. An invoice that normally arrives from an accounting system turns up from a different kind of source, with new bank details. Whatever the file check returns, a change in payment details is a reason to confirm with the supplier before paying. Fake Invoice Detection Through PDF Metadata goes through this case.

What a Reviewer Should Do

Treat the file check as the first, cheap layer, then match the next step to the result.

1. modified: do not rely on the document. Ask the sender for a fresh copy straight from the issuer, and keep the record of the check.
2. inconclusive: confirm with the issuer through a channel you found yourself. Look for corroboration that does not depend on the file: a second document from an independent source, an account-linked data feed, a call to the employer or institution.
3. intact: the file shows no sign of editing. For a high-value decision, still confirm the content with the issuer, because a file can be unedited and untrue.
4. High-stakes decisions: large loans, significant contracts and regulatory submissions deserve direct confirmation with the issuer regardless of the file result. Identity and content checks from a KYC provider sit alongside this; see KYC vs Document Forensics for how the layers divide the work.

The file check lowers the volume that needs the slow steps. It does not remove them. In healthcare credentialing the stakes are higher still.

Putting It in a Workflow

Run the check on every document that enters a review queue, and route by result: modified and inconclusive go to a person with the confirmation steps above. The same engine is available through the HTPBE? API for automated intake, and checks draw from one credit pool whether they come from the web tool or the API; current plans and credit packs are on the pricing page.

AI did not create document fraud. It made a polished fake cheap and fast, which pushes more weight onto the question the file can answer – was this changed after it was made – and onto the steps that confirm the rest with the issuer.