PDF Fraud Prevention: A Layered Playbook for Businesses
This article is a snapshot – content was accurate as of March 2026. The product evolves actively; specific counts, examples, and detection rules may have changed since publication – see the changelog for the current state.
PDF fraud is rarely one clever trick. It is an ordinary document – an invoice, a payslip, a bank statement, a repair estimate – that arrives by email or upload and gets accepted because nobody had a reason to doubt it. This playbook is the operating model we recommend across industries: five layers of control, a quick reference for each sector, an honest account of what a file check can and cannot do, and a checklist you can implement this quarter.
It is written for the risk, operations or compliance owner who has to set one standard across several teams; the single-industry detail is linked from the table further down.
No single control is enough. A file check catches documents that were changed after they were generated. A callback catches documents that are genuine but lie. Retention and escalation make sure that when either one fires, the outcome is consistent. Used together, they cover the ground each one leaves open.
The five layers
1. Intake file check
Check every document that carries money, a legal commitment or an eligibility decision before a person relies on it. The point of doing it at intake, rather than when someone feels uneasy, is that routine checks catch the documents that look perfectly normal.
Run the check on the file itself, not on a screenshot or a printout – a copy loses the information the check needs. Read the full result, not only the headline status: the stated origin of the document, the application that produced it and the dates should all make sense for what the document claims to be. A bank statement exported by an image editor, or a ‘2020 contract’ created last week, deserves a question before it deserves a decision.
The fastest way to make this routine is to wire a PDF tamper detection API into the upload or inbox step, so the result is attached to the case before a human opens the file. Pricing is one-off credit packs or monthly plans, so you can start with the highest-risk document type only.
2. Source confirmation
Establish where the file came from. A PDF forwarded by a third party, received from a free email address, or uploaded through a link you did not issue has a weaker chain of custody than one pulled directly from the issuer’s portal or sent through a channel you control.
Where you can, ask for the document to be sent from the issuer – the bank, the employer, the insurer – rather than by the applicant or the vendor. Where you cannot, record how it arrived – the channel, the sender address and the timestamp – because that record matters later.
3. Out-of-band verification
Confirm the facts through a channel the sender does not control. Call a number from your own records or the organisation’s official website – never from the email or the document itself. Ask whether they issued this specific document, for this amount, to this account.
This is the layer that stops payment-redirect scams, because the attacker often changes only the bank details on an otherwise genuine invoice. It also covers the cases a file check is not designed to answer (see below). For the full pre-payment routine, see how to check a PDF before payment.
Two supporting habits make this layer hold up:
- Keep a vendor record. Store confirmed bank details and contacts, and change them only after direct contact with the vendor – never because a PDF or an email says so.
- Treat urgency as a signal. ‘Pay today or service is suspended’ is how criminals buy time before discovery. Make it policy that urgency escalates to a supervisor and triggers more checking, not faster processing.
4. Retention of the evidence
Decide in advance what you keep. For any document that is queried, held or rejected, preserve the original file exactly as received, the check result, the correspondence around it and a note of who did what and when.
This is what makes a bank fraud report, an insurance claim or a police report workable later. Banks, insurers and police ask for the original file, and a report without it is harder to act on. Store it under your normal data-protection and retention rules.
5. Escalation
Write down what happens when someone suspects a document. Name who receives the report, what to attach, whether a pending payment or decision is held automatically, and when law enforcement or the issuer is contacted.
Without this, staff either ignore the doubt to avoid conflict or improvise differently each time. A short, specific process – one page – is better than a thorough one nobody reads. A workable page has four lines: who to tell, what to attach (file, check result, message), what is put on hold, and who decides when to release it. Train people on it regularly: new staff do not have the instincts that experienced staff have built, and the scenarios change.
What to apply in each industry
The five layers are the same everywhere. What changes is the document that gets targeted and the question to ask out of band.
| Industry | Documents most often altered | Layer to emphasise | Go deeper |
|---|---|---|---|
| Lending | Bank statements, pay stubs, tax documents | Intake check on every borrower-supplied file, plus confirmation with the issuer | Lending use case, mortgage use case |
| Insurance | Repair estimates, medical bills, receipts | Intake check at first notice of loss, evidence retention for disputes | Insurance claims fraud detection, altered claim PDFs |
| HR and hiring | Payslips, diplomas, employment letters | Intake check before the offer, confirmation with the employer or institution | HR hiring use case, payslip fraud in HR |
| Property | Deeds, wire instructions, tenancy paperwork, income proof | Out-of-band confirmation of any payment instruction | Tenant screening use case, PDF fraud in real estate |
| Accounts payable | Invoices, bank-detail change requests | Vendor record, dual approval and callback before release | Accounts payable use case, checking a PDF before payment |
For payments, add dual authorisation above a threshold you choose: one person reviews the document and its check result, a second confirms the order, the vendor and the amount against your records. Someone who compromises one person’s judgement or inbox must now deceive two.
What a file check can and cannot do
Be clear about this with your team, because over-trusting a check is its own risk.
A file check can tell you whether a PDF shows evidence of having been changed after it was generated, and whether the software that produced it fits the kind of document it is. It gives you a documented, repeatable result at the moment of intake, and it works on documents you have no other way to confirm quickly.
A file check cannot:
- Prove that the content is true. A document created cleanly with false information in it is a lie, not a modification, and only confirmation with the issuer exposes it.
- Prove intent. A flagged file shows the document changed; it does not show why, and plenty of changes are innocent, such as a re-saved or reformatted copy.
- Judge a scan or a photo the way it judges a native file. A scan or a photo cannot earn a clean result. The file only shows that a capture happened, so whether the paper itself is genuine has to be settled with the source.
- Replace identity checks, sanctions screening or credit decisions. It answers one question about one file.
That is why the check sits in a stack. Treat a clean result as ‘no evidence of change found’, and treat a flagged one as a reason to run layers 2 to 5, not as a verdict on a person.
Where your organisation is now: five levels
Most organisations sit at one of these. Moving up one level is a realistic goal for a quarter.
| Level | What it looks like | The next step |
|---|---|---|
| 0. Ad hoc | Documents are accepted on appearance; checking happens when someone feels uneasy | List the document types that move money or decide eligibility |
| 1. Manual | People read a document’s properties or compare details with records when they remember | Pick the one or two highest-risk document types and give them a fixed step |
| 2. Intake check on top-risk documents | Those documents are checked at intake and the verdict is recorded | Write the routing rule for each verdict, including inconclusive |
| 3. Systematic | All documents of the chosen types are checked automatically, with out-of-band confirmation and a retention rule | Start measuring: verdict mix, resolution time, callbacks that found a problem |
| 4. Reviewed | Metrics are reviewed each quarter and routing rules are adjusted from real outcomes | Extend to the next document type |
Who owns each layer
A layer with no owner is a layer that is skipped under pressure. A starting split for a mid-sized organisation:
| Layer | Owner | Evidence they keep |
|---|---|---|
| Intake file check | Operations or the system owner of the intake channel | Check ID and verdict on every record |
| Source confirmation | The team that receives the document | Channel, sender and time of arrival |
| Out-of-band verification | The approver, never the person who keyed the document | Who called, which number, what was confirmed |
| Retention | Records or compliance | Originals and results under your retention rules |
| Escalation | Risk or compliance | The one-page process and its owner |
Five numbers for a quarterly review
- Documents checked, split by verdict and, for
inconclusive, by the stated reason. - Time from a flagged result to a resolution.
- Outcomes of the flagged cases: innocent re-save, supplier or issuer correction, confirmed problem, unresolved.
- How often the out-of-band step was skipped or shortened, found by sampling closed cases.
- Payments or decisions released with a flagged file still open. The target is none.
None of these requires special tooling; they come from the check records and the case notes. If the fourth number is high, the fix is a process and training, not a different tool.
Implementation checklist
- List the document types in your process that move money, create a legal commitment or decide eligibility. Rank them by value and by how often you receive them from outside.
- Pick the top one or two and add the intake check to that step, ideally automated through the API.
- Define what your team does with each outcome: no edit found, edit found, and ‘no edit found, but the origin of the file cannot confirm its integrity’. Route the last one to source confirmation (layer 2); it is a finding about the file, not a suspicion about the sender.
- Write the out-of-band script: who calls, which number source is allowed, what exactly is confirmed.
- Set the dual-authorisation threshold for payments and the rule for changing vendor bank details.
- Decide what evidence is retained, where, and for how long.
- Publish the one-page escalation process and name an owner.
- Sign your own outgoing documents with a valid certificate, so recipients have something to compare against when a fake claiming to come from you arrives.
- Train the team, then repeat it on a schedule, and review a sample of cases each quarter to see where the process was skipped.
Start with the highest-risk document type, make the steps routine, and expand from there. A process that feels normal to your staff is harder to defraud than one that is switched on only when someone is already suspicious.