Grant and Relief-Fund Fraud: Altered Financial PDFs

A grant, subsidy or relief program asks applicants for much the same paperwork a lender does: bank statements, payroll records, tax returns, a profit and loss statement – and later, invoices showing what the money paid for. The difference is who reads it. A lender has an underwriting team paid to read that paperwork with suspicion. A funding program usually has a program officer, an eligibility checklist and a disbursement deadline.

Grant and relief-fund document fraud rarely looks dramatic. It is a real bank statement with a changed balance, a payroll register with an extra name, an invoice with a higher total. The page reads correctly because a real document was edited, not invented from nothing. Reviewers read what a document says; programs rarely check whether the file was changed after the issuing system produced it. A structural PDF check answers that one question – was this file edited after it was created? It does not tell you whether the applicant qualifies, whether the figures are true, or who sent the file.

When money moves fast on self-certified paperwork, the gap gets expensive. Paycheck Protection Program (PPP) fraud is a well-documented example, and the official record on it is summarised below.

Three checkpoints where applicant PDFs decide the money

A funder holds applicant-submitted PDFs at three distinct moments, and each one releases or commits money.

1. Eligibility intake. The applicant proves they exist as a going concern and meet the program’s thresholds: revenue, headcount, losses, location. Bank statements, tax returns and payroll summaries carry this step.
2. Pre-disbursement. Before the first payment, programs often ask for updated statements, a bank account letter for the payee details, or a signed budget. A changed account number here redirects the award itself.
3. Reimbursement and post-award review. After the award, grantees claim against their budget with invoices, receipts and payroll records for staff the grant funds. This is where most of the documents arrive, spread over months or years.

In most programs, document scrutiny is concentrated at the first checkpoint. Most of the documents arrive at the third.

The documents that carry the decision

Grant money is decided by the same handful of document types that decide loans. Each has its own altered-PDF pattern, described here by outcome rather than method:

• Bank statements – a statement with a changed closing balance or a removed overdraft, used to show need or capacity. See bank statement tamper detection.
• Payroll records and pay stubs – a payroll summary or pay stub showing staff or wages the business does not have, used for headcount-based awards and payroll reimbursement. See pay stub tamper detection.
• Tax returns – a return with a revised gross receipts line, used to prove revenue loss against a prior year. See tax document tamper detection.
• Financial statements and profit and loss reports – a P&L with a deeper loss than the books show.
• Reimbursement invoices and receipts – an invoice with a higher total or a receipt re-dated into the grant period. See invoice tamper detection and expense reimbursement checks.

All of these share one property that matters for a funder: a well-made edit looks like the original on screen, so a careful reader often has nothing to catch.

What PPP and relief-fund history showed

The SBA Office of Inspector General’s June 2023 fraud landscape report (Report 23-09) is a detailed primary record. It describes how emergency measures allowed the SBA to ‘reduce or eliminate key internal controls and rely on self-certification of eligibility to expedite aid’, and estimates that the SBA disbursed more than $200 billion in potentially fraudulent COVID-19 Economic Injury Disaster Loans (EIDLs) and PPP loans – at least 17% of disbursed funds, split as more than $136 billion in EIDLs and $64 billion in PPP funds. The SBA disputed that estimate in its response, published in the same report, and put the body of loans likely to be fraudulent at approximately $36 billion. Either figure is large; the gap between them is a reminder that ‘potentially fraudulent’ is not ‘proven’.

Two details in the report matter for grant administrators. The first is that EIDL advances ‘were essentially grants that did not need to be repaid’, and applicants self-certified their headcount, a number ‘not vetted by SBA’. The second is that documents kept deciding money after disbursement: in one case the report describes, ‘the fraudulent payroll records were then submitted to SBA to obtain 100 percent loan forgiveness.’

Two limits apply. The report does not break losses down by how the documents were produced, and many of the schemes it describes ran on stolen identities, fabricated employer numbers and businesses with no operations – problems a file check does not touch. And where a scheme accepts a self-declaration instead of a document, there is no file to inspect at all. In a separate example, the UK’s Bounce Back Loan Scheme had ‘limited verification, and no credit checks on borrowers’, according to the National Audit Office’s December 2021 update; the department’s March 2021 estimate that 11% of loans, worth £4.9 billion, were fraudulent was described as ‘highly uncertain’; a later October 2021 revision put it at 7.5% of loans, a figure the NAO said it could not assure.

For how lenders handled PPP loan application fraud and what changed in their document review afterwards, see our post on SBA loan stip-document fraud. For the wider public-sector picture, see government document fraud and PDF checks.

Why application-time review misses post-award claims

Intake review gets the experienced staff: a few documents per applicant, read once, against clear criteria. Post-award claims arrive monthly or quarterly for the life of the grant, many small documents per grantee. Reviewers check them against budget lines – is this cost allowed, does it fall in the period, does the arithmetic match the claim – which is a question about the content, not the file. Audits are usually sampled. And a grantee who applied honestly can, under cash pressure two years later, edit one receipt total.

So reimbursement documents are where editing is cheapest and review thinnest: one changed figure on one invoice, among hundreds in the queue.

What a modification check tells a program officer

HTPBE? runs a structural PDF tamper detection check on each file and returns one of three verdicts:

• intact – no structural modification detected.
• modified – the file carries structural evidence that it was changed after it was created.
• inconclusive – the check cannot give a full answer for this file, so it says so instead of guessing. Treat it as unanswered rather than cleared, and confirm the document with its source wherever the decision depends on it.

A modified result names what was found with public marker IDs such as HTPBE_MULTIPLE_REVISION_LAYERS (the document was saved again with changes after creation), HTPBE_EDITING_TOOL_FINGERPRINT (a known PDF editor left its traces) or HTPBE_DATES_DISAGREE (the modification date differs from the declared creation date). Each check also gets an ID you can store with the application as a record of the check.

A trimmed example of a result:

{
  "id": "506a6b1b-1360-48a2-b389-abb346f85d04",
  "filename": "reimbursement-invoice-q3.pdf",
  "status": "modified",
  "modification_markers": ["HTPBE_MULTIPLE_REVISION_LAYERS", "HTPBE_EDITING_TOOL_FINGERPRINT"],
  "usage_caution": {
    "safe_for_automated_adverse_decision": false,
    "recommended_action": "route_to_human_review"
  }
}

The usage_caution field is always present, and safe_for_automated_adverse_decision is always false. That reflects how the verdict should be used: intake, then the check, then flagged files routed to a person who decides what the edit means and whether to confirm the document with its source. Source confirmation – the bank, a tax transcript, the payroll provider – stays the reference. The check helps sequence it: files returned as modified go to the front of the confirmation queue. For an intact file the API returns no_action: the file check raised no flag. That is not the same as saying source confirmation is unnecessary – an intact file simply sits lower in the queue.

What the check cannot tell you

• Not identity. It does not establish who submitted the file or whether the business exists. That is a KYC and registry question.
• Not eligibility. It does not decide whether an applicant qualifies under program rules.
• Not whether the numbers are true. HTPBE? does not read balances, totals or headcounts, and does not check arithmetic. It examines the file’s structure, not its content – which is exactly why an edit that leaves the page looking perfect can still show up.
• Not issuer confirmation. intact means no structural modification detected. It does not mean the document is authentic or that the bank issued it.
• Not fabrication from scratch. A document built with false content from the start, rather than edited, has no later edit for a modification check to find. Whatever verdict such a file gets – intact included – it says nothing about whether the content is true; source confirmation covers that case.
• Not scans. A scanned or print-to-PDF document cannot return intact; confirm it with the issuer instead.

Wiring it into intake

Platform teams that own the upload step can call the HTPBE? API with one POST per file. The file URL must be downloadable without authentication, so applicant documents in private storage need a short-lived signed link:

curl -X POST https://api.htpbe.tech/v1/analyze \
  -H "Authorization: Bearer $HTPBE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://storage.example.org/signed/applicant-123/bank-statement.pdf"}'

# returns {"id": "..."}; fetch the verdict and marker IDs with:
curl https://api.htpbe.tech/v1/result/YOUR_CHECK_ID \
  -H "Authorization: Bearer $HTPBE_API_KEY"

Store the check ID with the application record. Send modified files to your existing review queue rather than to an automatic decision; for inconclusive files, which the check cannot answer, confirm with the source wherever the decision depends on them.

Frequently asked questions

Can a PDF check tell whether an applicant qualifies for a grant?

No. A structural check answers whether the file was edited after it was created. Eligibility depends on the program’s rules and on facts the file may or may not state truthfully – that stays with the program officer and with source confirmation.

How is this different from a lender’s stip review?

The check is the same; the timing differs. A lender concentrates its review before funding, while a grant program keeps receiving documents after the award, through reimbursement claims and close-out reports – so the check belongs on post-award documents too, not just at intake.

What happens with scanned documents?

Scanned and print-to-PDF documents cannot return intact, whatever happened to the original. If a program needs to rely on a scanned document, confirm it with the issuer.

Does a modified result mean the applicant committed fraud?

No. It records the fact of an edit, not the intent behind it. Redacting an account number, merging pages or re-exporting a file are edits too. A modified result is a reason to route the file to a person, never grounds on its own to deny an application.

Try it on your own applicant files

The fastest way to see what the check returns on your documents is to sign up and run a few through the web app – new accounts get five welcome credits. After that, as of October 2026, checks cost $5 for 8 or $15 for 25 as one-time credit packs, or plans start at $15 a month for 30 checks; see pricing for current tiers. Whatever the result, treat it as one input to review: none of the three verdicts on its own should be the sole basis for denying an applicant.