Document Forgery Detection Methods Compared

A lender receives a payslip as part of a loan application. The PDF came from a real payroll system at a real employer. Before uploading it, the applicant opened it in a PDF editor, raised the gross pay, adjusted the tax and net lines so they still add up, and saved the file again.

On screen the payslip looks exactly like the one the payroll system produced. The extraction step reads every figure cleanly. The arithmetic checks pass, because the applicant did the arithmetic. Nobody calls the employer, because the application looks ordinary. The only place that might record what happened is the file itself: it typically now carries evidence of being modified after the payroll system created it.

That scenario is a composite, not a specific case. It shows why document forgery detection is not one method: different methods answer different questions, and the edited payslip passes every check that asks the wrong one.

Document forgery detection: the four method classes

Document forgery detection splits into four classes of method. Each asks a different question:

1. Manual review – does a trained person, looking at the document, believe it?
2. Content-based checks – is what the document says consistent with itself and with other data sources?
3. Identity and issuer checks – is this the right person, and did the stated issuer actually issue this document?
4. Structural PDF forensics – was the file changed after it was created?

Content checks judge what the document says; structural checks judge the file’s history. Each misses what the other sees. Manual review and issuer confirmation sit on either side of them: one is human judgement on the surface, the other is the only route to the issuer’s own answer.

Manual review: what a human sees and misses

A reviewer reads the document the way its recipient is meant to: logo, layout, names, dates, totals. Good reviewers catch a lot: an employer that doesn’t exist, a salary that doesn’t fit the job title, a story that doesn’t hang together across the application. Human judgement is also where context lives.

What a reviewer cannot see is the file underneath the page. A PDF that was edited and re-saved can render exactly like the original, so the edit is invisible to anyone looking at it. Manual review also does not scale: every document costs the same human time, and attention drops on the hundredth file of the day. We compare the two approaches directly on PDF tamper detection vs manual review, and we break down the cost side of manual review separately.

Content-based checks: what they validate and what slips through

Content-based methods automate the question ‘is what this document says believable?’. The class covers several techniques:

• Extraction and OCR – pulling text and figures out of the document so they can be checked by software rather than by eye.
• Internal consistency – does the arithmetic work, do the dates line up, do the totals match the line items, do the account numbers have the right format?
• Visual inspection – font, alignment and pixel-level analysis, including AI models trained to spot visual manipulation in a page image.
• Data cross-checks – comparing the extracted values against an outside source such as a bank feed, a payroll provider or a company registry.

These methods catch things structure never can. A document with inconsistent figures fails an arithmetic check whatever its file history. A visual model can flag a pasted-in block that doesn’t match the surrounding page. And a data cross-check is the only automated method on this list that tests whether the content is true: if the payroll provider reports a different salary, the payslip is wrong regardless of how it was made.

The limit is that content checks evaluate the result of an edit, not the act of editing. A careful edit to a real document can leave content that is internally coherent and visually clean. Unless a cross-check against an independent source is available for that exact figure, the edited payslip from the opening passes. Cross-checks also depend on access: not every applicant connects a bank account, and not every employer, landlord or supplier is reachable through a feed.

Identity and issuer checks

Identity checks (KYC) confirm that the person in front of you is who they say they are – a government ID, a selfie, a liveness check. They answer a question about the person, not about the payslip or bank statement that person uploads. A real applicant with a valid passport can still submit an edited document. We go through that gap in detail in KYC vs document forensics.

Issuer confirmation – calling the employer, the bank or the registrar – is the strongest evidence that a document was actually issued with the values it shows. It is also slow, manual and often impossible at volume, so most teams reserve it for files something else has already flagged.

Structural PDF forensics

Structural forensics does not interpret what the page says; it examines how the file was built and changed. A PDF is a structured container with its own records, not a picture of a page. Editors can append revisions to it, it carries metadata naming the software that produced it and when, digital signatures cover a defined part of it, and pages can be assembled from more than one source. When a file is opened and saved again, those records usually change, and that change is what structural forensics looks for.

HTPBE? works only at this layer. It does not extract or interpret the figures, run OCR, check arithmetic, compare values with outside data or judge what the page looks like. It answers one question – was this PDF modified after it was created – and reports outcomes such as:

• ‘Content changed after the document was digitally signed’
• ‘Document re-saved by another tool after its original creation’
• ‘Evidence that a digital signature was stripped after signing’

Those are labels from the public list on how HTPBE? works, which as of October 2026 holds 63 checks across 8 categories. The result is a verdict – intact, modified or inconclusive – plus the named markers that support it. There is no numeric risk score.

Each verdict has a narrow meaning. modified means the file shows evidence of being edited after creation; it is not a finding of fraud, and it should route the file to a person rather than trigger an automatic rejection. inconclusive means the file offers limited structural evidence either way, typically because it came from consumer software, a scanner or a print-to-PDF step – scans and print-to-PDF output never return intact. What inconclusive means covers how to handle that outcome. intact means no structural edit evidence was found.

This is document tamper detection in the narrow sense, and it is one part of PDF fraud detection, not all of it. The anatomy of a modified PDF walks through what changes inside an edited file, binary PDF modification detection goes further into the format, and the product overview is on PDF tamper detection.

Side-by-side comparison

Every blind spot in that last column is addressed, at least in part, by another row, which is the case for layering them.

What none of these methods can prove

None of the four classes, alone, proves that a document is authentic.

An intact structural result means no evidence of editing was found in the file. It does not mean the issuer produced it, that the figures are correct or that the applicant is who they claim to be. A document whose content was false from the start carries no evidence of a later edit, because nothing was changed afterwards, and a well-resourced forger can sometimes produce a file that shows no structural sign of editing. Structural modification detection does not claim to catch those cases; the reasoning is in can someone create a fake PDF from scratch?. Content and issuer checks are the layers that address them.

The reverse also holds. A clean content check means the numbers are coherent, not that the file is untouched. A matched identity means the person is real, not that their documents are. And no automated method replaces an expert examiner or the issuer’s own confirmation when a decision is consequential. Every result here is an input to a human decision, not the decision.

PDF tampering detection in a layered workflow

In practice, PDF tampering detection sits at intake, before a document reaches the more expensive steps. The shape is similar across industries:

• Lending – check bank statements and payslips at upload; route modified files to an underwriter before the application moves on.
• HR and background screening – check diplomas, reference letters and employment records as they arrive, and contact the issuer for flagged files.
• Insurance – check repair estimates, invoices and medical bills before claim scoring; insurance fraud detection methods covers that vertical in depth.
• Accounts payable – check supplier invoices before payment, and confirm bank detail changes by phone through a known contact.

The structural check is automated and runs per file, so it can sit on every upload and leave human and issuer time for the files that earned it. More examples by document type are on detect fake documents, and the integration view is on the document fraud detection API page.

How to choose and combine methods

Decide which questions you need answered and where each answer is cheapest:

• Can you get the data from the source? If a bank feed or payroll connection exists for a figure, a data cross-check tests whether it is true. Use it where it is available.
• Do you know who the person is? If not, you need an identity check as well – a clean document from the wrong person is still the wrong answer, and a person who passes an identity check can still submit an edited file.
• Are the documents PDFs that applicants or suppliers could have edited? Then a structural check on every file is designed to catch the real-document-edited case that content checks can miss.
• What happens on a flag? Decide in advance who reviews a modified or inconclusive result and when you contact the issuer. A flag without a review path tends to become an automatic rejection, which is the wrong use of any of these outputs.

If the structural layer is the one you are missing, try it on a file you already have. New accounts start with 5 welcome credits, then checks are pay-per-check. For developers, the HTPBE? API is one POST with a PDF URL, returning the verdict and named markers, and test keys are free on every plan.

Frequently asked questions

What is document forgery detection?

Document forgery detection is the set of methods used to decide whether a submitted document can be relied on. In practice it is four different questions answered by four different method classes – manual review (does a trained person believe it), content-based checks (is what it says consistent with itself and with other data sources), identity and issuer checks (is this the right person, and did the issuer actually issue it), and structural PDF forensics (was the file changed after it was created). Each class fails in different places, so they are normally layered rather than chosen between.

Can document forgery be detected without reading the document’s content?

Some of it can. Structural PDF forensics does not interpret the figures or names on the page, and it does not judge what the page looks like. It examines how the file was built and changed – revision layers, metadata and timestamps, signature coverage, how pages were assembled – and reports whether the file carries evidence of being edited after it was created. It is built to catch a real document that was opened and re-saved with new figures, even when the edit is invisible on screen. A document whose content was false from the start carries no such evidence, because nothing was changed afterwards, and structural forensics says nothing about whether the content is true. Those questions belong to content and issuer checks.

What is the difference between structural PDF forensics and content-based document checks?

Content-based checks look at what the document says and shows – extracted text and numbers, arithmetic, fonts and pixels, and how the data compares with bank feeds, payroll records or registries. Structural PDF forensics looks at the file itself – whether it was modified after it was produced. Content checks tell you whether the numbers and pixels look right; structural checks tell you whether the file was edited after it was made. Each misses what the other sees, which is why they work best together.

Does an intact result prove a document is authentic?

No. An intact verdict means no structural evidence of editing was found in the file. It does not prove the issuer produced the document, that the person submitting it is who they claim to be, or that the figures are true. A document whose content was false from the start carries no evidence of a later edit, because nothing was changed afterwards. Treat intact as one input to the decision, and confirm with the issuer when the stakes call for it.