Right to Work Document Fraud Detection — UK Compliance
A statutory defence depends on the documents you held — and a tampered PDF in your file is the documents you held. UK employers face civil penalties of up to £60,000 per illegal worker. The statutory excuse depends on having performed a compliant RTW check and retained the supporting documents. When those supporting PDFs were tampered before they reached your file, your defence collapses on Home Office audit. Read the file before it gets filed.
htpbe? analyzes the structural layer of the PDF file — the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. The official online RTW check (gov.uk share code) and IDVT vendor checks remain the primary identity step. htpbe? catches tampering on the supporting PDF evidence you keep on file.
When htpbe? returns INCONCLUSIVE on a Right-to-Work supporting document, that’s itself a fraud signal in this context — real gov.uk-issued letters and IDVT results always come from institutional systems, never from a desktop tool.
One REST call, one deterministic verdict
Upload the PDF. The API returns INTACT, MODIFIED, or INCONCLUSIVE with named markers — in about three seconds.
How fake and tampered RTW supporting PDFs actually look
Three real fraud mechanics we catch at the structural PDF layer.
Share-code letter fabricated or edited
A worker generates a real share code on gov.uk for one immigration status, then opens the resulting confirmation letter in Word and edits the conditions or expiry — or fabricates an entire letter from scratch using the gov.uk template. Producer field shifts from gov.uk to Microsoft Word; structural metadata diverges.
BRP/passport scan with edited expiry or conditions
A scanned BRP or passport ID page PDF is opened in Adobe Acrobat and the visa expiry date or conditions are edited. The image layer is preserved; the underlying text layer or annotation layer changes. Structural analysis surfaces the divergence.
Supporting employment evidence backdated
For sponsor-licence audits, supporting payslips, contracts, or training records are backdated to align with the period the worker was supposedly compliant. Modification timestamps reveal the post-creation edits.
The scale
Why your existing checks miss this
The IDVT covers the live identity check. It does not cover the file you keep.
Statutory defence requires both: a compliant check AND the retained evidence.
IDVT vendors (TrustID, Yoti, Onfido) handle the live identity verification step — and the statutory defence requires this for non-British/Irish citizens. But the RTW evidence file you retain for Home Office audit is what the auditor opens, not the IDVT live session. If a supporting PDF in that file was tampered between issuance and your retention, the defence falls. htpbe? inspects every supporting PDF at the moment it lands in your file — standalone, no Home Office API, no IDVT platform required.
Five forensic layers, one deterministic verdict
Every PDF we receive passes through the same structural pipeline — no model training, no thresholds to tune.
Metadata analysis
Creation and modification timestamps, producer and creator fields, XMP metadata — the first layer exposes basic tampering.
File structure
Xref tables, trailer chain, incremental updates. Any edit after export leaves a structural fingerprint here.
Digital signatures
Signature chain integrity and post-signature modifications produce deterministic markers. Certainty-level signal.
Content integrity
Fonts, objects, embedded content, page assembly. Multi-session edits and inserted objects are visible at this layer.
Verdict with markers
Deterministic output: INTACT / MODIFIED / INCONCLUSIVE, with named markers for every finding — suitable for audit trail.
Right-to-Work supporting PDFs we check
Every type listed below is analyzed at the structural file layer — not the rendered image.
Detection capabilities
Deterministic structural signals. No probabilistic scores, no model training.
Producer signature on the supporting PDF
gov.uk-issued letters carry a recognisable producer signature. IDVT vendor outputs (TrustID, Yoti, Onfido) also carry recognisable signatures. When the producer is Microsoft Word, Excel, LibreOffice, or a generic PDF library, the document was authored on a desktop — not exported from gov.uk or an IDVT platform.
Incremental update trail
Edits to share-code letters or scanned BRP/passport PDFs leave incremental updates in the xref chain. Authentic single-session exports have one xref; tampered files have two or more.
Annotation and form-field tampering
Form-field edits and annotation layer changes are tracked separately in PDF structure. Edited expiry dates or conditions on overlay annotations show structural traces.
Modification timestamp gap
A real share-code letter generated yesterday has CreationDate ≈ ModDate. A months-later modification on a "freshly issued" letter is a high-confidence flag for post-export editing.
Image stream artefacts
Scanned BRP or passport PDFs with edited regions show image-stream metadata mismatches — the edited region carries different JPEG/PNG compression than the surrounding scan.
Font subset divergence across pages
Multi-session edits or multi-source assembly leave font subset prefix shifts across pages of the same supporting document.
Two HTTP calls to verify any RTW supporting PDF
Buyers can skip this section — developers, the integration is two HTTP calls.
Step 1 — submit the PDF
curl -X POST https://api.htpbe.tech/v1/analyze \
-H "Authorization: Bearer $HTPBE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://your-storage/share-code-letter-A12B34C56.pdf"}'Step 2 — read the verdict
{
"id": "r1t2w3a4-5b6c-7d8e-9f0g-h1i2j3k4l5m6",
"status": "modified",
"modification_confidence": "high",
"modification_markers": [
"Microsoft Word producer detected on a gov.uk-format letter",
"Two cross-reference tables — incremental update",
"Annotation layer change detected"
],
"producer": "Microsoft Word",
"creator": "Microsoft Word",
"creation_date": 1707091200,
"modification_date": 1707350400,
"has_digital_signature": false,
"xref_count": 2,
"has_incremental_updates": true
}A genuine share-code confirmation comes from gov.uk — not Microsoft Word. Combined with two xref tables and an annotation-layer change, the verdict is modified at high confidence. The letter was authored or edited on a desktop after the gov.uk-issued original.
Customer Stories
Teams that stopped document fraud
Compliance, finance, and risk teams use htpbe? to catch manipulated PDFs before they become costly mistakes.
Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.
Sarah M.
AP Manager
United States
We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.
Lars V.
Risk Analyst, Online Lending
Netherlands
Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.
Priya K.
HR Operations Lead
India
Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.
Julien R.
Fraud Analyst, Fintech
France
Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for verified originals when something is flagged. Already saved us from a few bad decisions.
Marta S.
Compliance Coordinator
Spain
One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.
Tariq A.
Finance Manager
United Arab Emirates
Frequently asked questions
modified or inconclusive with producer-mismatch and missing-metadata flags.inconclusive — institutional metadata is gone because the scanner authored a fresh PDF. Edited regions in scans (expiry dates, conditions) often leave image-stream metadata mismatches that htpbe? flags. Combine with IDVT or manual checks for raster image content.Related solutions and guides
HR & Hiring
Pre-employment and onboarding document fraud detection for UK HR teams.
Sponsor Licence Document Fraud Detection
Sister page — same forensics for sponsor-licence supporting evidence.
KYC & Onboarding
Structural PDF forensics for proof-of-address, bank letters, and corporate documents.
Secure your workflow
Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.