The Real Cost of a Missed Document Fraud: A Loss Model

Before a single number: this model covers one narrow kind of fraud – the kind that rides on a PDF that was edited after it was created. A bank statement with the closing balance painted over. A pay stub with the salary line bumped. An invoice with the payee account number swapped. That is the slice HTPBE? addresses, and it is the only slice this model prices.

It does not cover a document fabricated from scratch, a document whose figures were false from the start, an AI-generated document, or identity fraud – whether a person is who they claim to be is a different problem (KYC/IDV) solved by different tools. HTPBE? reads the file’s structure, not whether the figures printed inside it are true. Keep that boundary in view, because everything below is scoped to it. If you want the wider numbers, the 2026 document-fraud statistics roundup is the place for scale; this piece is a model you work through with your own numbers.

The two costs you are actually weighing

Every fraud-check decision is a trade between two costs that never appear on the same invoice:

• The cost of checking – what you pay the tool, plus the time your team spends reviewing what it surfaces.
• The cost of missing – the loss when an altered document clears your process and the decision it supported turns out to be wrong.

The first is a line item you can see. The second is invisible until it happens, and by then it is usually unrecoverable. The point of a model is to put a defensible number on the invisible one so the two can sit on the same page.

What follows is a formula, a worked example, a sensitivity table, and notes on where to source each input. Fill in your own figures – none of the cells is a claim we are making about your business.

The formula

Two outputs, built from four inputs you own:

• Monthly cost of checking = tier price + review cost.
• Review cost = (documents your own sample surfaces for review) × (minutes per review ÷ 60) × (fully-loaded hourly cost of a reviewer).
• Monthly exposure = volume × your fraudulent-alteration rate × average loss per case. This is the gross size of the problem before any checking – the expected monthly loss if nothing is caught. All three terms are yours; we supply none of them.
• Break-even interval = average loss per prevented case ÷ monthly cost of checking.

The break-even interval is the headline. It answers one question: prevent one loss of this size every N months, and the programme has paid for itself. A larger N is more forgiving – you can go that many months between prevented cases and still come out even.

Two different rates feed this, and conflating them is the most common mistake. The flag rate is the share of your documents the check surfaces for review, benign edits included, and it drives review cost. The fraudulent-alteration rate is the share of all your incoming documents that are maliciously altered – a property of your traffic, not of the check – and it drives exposure. They are not subsets of one another, and they come from different places; the inputs section below says where.

Notice what is not in the formula: no catch rate, no detection-accuracy figure, no prevented-loss percentage. That omission is deliberate – see the limits section.

The cost of a check (pricing snapshot, as of October 2026)

HTPBE? pricing in USD at the time of writing – blog posts quote pricing as a point-in-time snapshot:

For lower or irregular volume, one-time credit batches avoid a subscription: $5 for 8 credits (about $0.63 a check) or $15 for 25 credits (about $0.60 a check). One credit is one check, and signup includes five welcome credits. Pick the row that covers your monthly volume; that price is the first term in the monthly cost of checking.

A worked example (illustrative – not a benchmark)

Round, invented numbers, chosen only to show the arithmetic:

• Volume: 300 documents a month → the Growth plan ($149) covers it.
• Flag rate from your own sample: 8% → 24 documents surfaced for review each month.
• Review effort: 10 minutes each at a fully-loaded $60/hour → $10 a review → $240 in review time.
• Monthly cost of checking: $149 + $240 = about $390.
• Fraudulent-alteration rate you estimate from your own fraud history: 0.5% → roughly 1.5 maliciously altered documents a month.
• Severity you supplied: $25,000 average loss per prevented case.

Monthly exposure = 300 × 0.5% × $25,000 = $37,500 in gross expected loss – the size of what you are protecting against, on your own numbers, if nothing is caught.

Break-even interval = $25,000 ÷ $390 ≈ 64 months. In words: prevent one $25,000 loss roughly every five years and the programme pays for itself. Over a year it costs about $4,680; at that severity, one prevented case covers a little over five years of spend.

Set the two against each other: at a 0.5% alteration rate and that volume, a maliciously altered document arrives about every 20 days, while you only need to prevent one loss every 64 months to clear the cost. How much of that gap you actually close is your own judgement – the model sizes the opportunity; it does not promise the catch. Every figure here is made up to demonstrate the method; none is a performance claim.

Sensitivity: the inputs that move the answer

Severity and the monthly cost of checking swing the result far more than anything else. The table shows the break-even interval in months (average loss ÷ monthly cost) across a plausible range. Read a cell as: prevent one loss this size every this-many months to break even. Higher is more forgiving. Every cell is your assumption, not an HTPBE? claim.

The column you land in is set by your flag rate and reviewer cost; the row by your severity. The pattern is the useful part: once average severity reaches the tens of thousands, the interval you need to clear to break even stretches to years, which is why the decision usually turns on how confident you are in your severity input – not on the subscription price.

The exposure side moves on a different pair: your fraudulent-alteration rate and your severity. This grid shows monthly exposure (volume × rate × severity) at 300 documents a month – swap in your own volume to rescale every cell. The rate here is the malicious share, not the flag rate.

Choosing your inputs honestly

Volume

Documents of the relevant type you process per month – applications, claims, invoices, whatever carries the risk.

The two rates – and why you need your own sample

Published fraud rates are a reasonable upper bound for context, but each one is broader than the slice this model prices, so narrow it before you use it:

• CoreLogic’s 2024 Mortgage Fraud Report put roughly 1 in 123 US mortgage applications as showing indications of fraud in Q2 2024. That is indications, not confirmed fraud; US mortgage only; and it spans multiple fraud types the index tracks, not just documents altered after creation.
• Cifas’s Fraudscape 2025 recorded false documentation as the most common reason given for a false-application filing, at 30% of filing reasons, across 21,000+ false-application cases in the UK National Fraud Database (up about 10% year on year). That 30% includes documents fabricated from scratch – outside this model’s scope – so the altered-after-creation share is some fraction of it.

Treat these as the top of the funnel. Your two rates come from different places: a sample run through the check gives you the flag rate directly, while the fraudulent-alteration rate comes from your own confirmed-fraud records and reviewer adjudication – a set of verdicts cannot tell you what slipped through unflagged. Both are almost certainly lower than any headline figure above.

Severity – your number, not ours

Average loss per prevented case is the input with the largest leverage and the weakest public data. There is no verified per-incident figure for altered-PDF lending fraud specifically, so we do not supply one and you should distrust anyone who does. Use your own recovered-loss records, or the exposure of a single bad decision in your workflow: the advance you would have funded, the claim you would have paid, the invoice you would have settled.

Review cost – budget for the whole queue

A check that surfaces a document does not say ‘fraud.’ It flags that the file was edited, or that its origin cannot be confirmed, and a person then decides what that means. Much of what it surfaces is likely to be legitimate: documents get merged, redacted or re-saved for ordinary reasons, and the check reports those edits the same way it reports a malicious one – it records that the file changed, not why. That is a correct verdict – the fact of an edit – not a false positive. Your reviewer supplies the judgement of intent.

So budget review time for the whole surfaced queue, not just the genuine fraud cases. How that split actually falls – how much of your flagged queue is benign – is exactly what your own sample tells you; the flag rate you plug in should come from that sample, never from someone else’s published statistic.

Optional: the fully-loaded multiplier

If your severity input is the direct loss only, you may be understating it. LexisNexis’s True Cost of Fraud 2025 found that in US Lending, every $1 of fraud loss carried about $5.38 in total cost once associated costs are folded in. Two warnings before you use it: it multiplies the loss (total ≈ loss × 5.38) rather than adding a flat $5.38, and it is North America only. If your severity figure is already your fully-loaded cost, applying the multiplier double-counts – so use it only on a bare direct-loss number. Applied to the $25,000 example, the fully-loaded figure becomes about $134,500, which lengthens every break-even interval in that row by the same factor: $134,500 ÷ $390 ≈ 345 months instead of 64. A bigger per-case loss is easier to justify checking against.

The cost of missing is also the cost of a late catch. The ACFE’s 2026 Report to the Nations – occupational insider fraud, a different population and the wrong base for a per-incident input – still makes the timing point: a typical case ran about 12 months before detection. A missed edit compounds until something unrelated surfaces it.

What this model deliberately does not claim

• No HTPBE? catch rate, accuracy, or prevented-loss percentage. No published evaluation of ours exists to supply one, so any such rate in your version of the model is an assumption you own, not a number we stand behind.
• ‘Documents surfaced for review’ is never ‘fraud caught.’ The check routes a document to a human; the human decides. Counting surfaced documents as caught fraud would inflate every number here.
• intact is not ‘authentic.’ It means no disqualifying structural evidence was found – nothing about whether the contents are true.
• inconclusive is not suspicion. It is a finding about a document’s origin, not grounds to decline anyone. The model routes flagged documents to review; it does not auto-reject.
• The check does not read amounts, totals or balances. It judges structure, not arithmetic. That boundary is the point of the tool, not a gap in it – whether the salary figure on a pay stub is true is a content question this model does not price.

If the build-or-buy question is still open for you, that is a separate calculation – build vs buy for PDF tamper detection covers the maintenance side, and the PDF forensics API pricing breakdown compares published costs across the category. This model assumes you have decided to check and want to size the return.

Run it on your own documents

The one input you should not guess is your own flag rate, because it sets the entire review-cost line. The honest way to get it is to run a sample of your real documents through the check and read the actual queue off your own results – how many come back flagged, and how the review time actually lands.

Create an account and your five welcome credits cover the first checks straight from the web app; if you would rather script the sample, create a live API key in your dashboard and point it at the document fraud detection API. Either path gives you real verdicts on your own files – the only number in this model worth more than an assumption. For how the three verdicts map to a decision, what an inconclusive result means walks through each one; see current pricing for the tier that fits your volume, or how the check works for the forensic layers behind the verdict.