Fake Asset Letter Detection – Catch Tampered Mortgage PDFs
A gift letter is a one-page PDF that decides whether the down payment counts – and one borrowers know how to fake. Mortgage processors clear asset letters and gift letters as evidence of down-payment funds. The borrower needs the donor to confirm the money is a gift, not a loan; or the bank to confirm the balance. When the donor is reluctant – or when the balance does not actually exist – the temptation is the same: edit the letter or build one in Word with a lifted signature.
HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally altered or fabricated asset / gift letter, we’re the most specific tool for it.
When HTPBE? returns INCONCLUSIVE on an asset or gift letter, that’s the expected baseline for this document type; combine with other markers before flagging.
The problem
Modern document fraud is invisible to visual review
A growing class of document fraud opens a genuine PDF, edits a balance, a date, or a beneficiary, and re-saves it. Visually nothing changes – the document passes pixel-level review, layout review, and KYC.
Structural PDF analysis reads the layers rendering engines never expose: revision history, object structure, signature coverage maps. That is where edits leave fingerprints they cannot wipe.
Common tampering patterns
- Modified balances or totals after export
- Swapped IBAN or beneficiary on invoices
- Post-signature edits on contracts
- Backdated issue and modification dates
- Fabricated documents from consumer PDF tools
What this looks like
How fake and tampered asset / gift letters actually look
Three real fraud mechanics we catch at the structural PDF layer.
Real letter edited after issuance
A genuine asset letter was issued by the bank or signed by the donor. Borrower opens it in any PDF editor, edits the balance figure or the relationship-to-borrower line, exports as PDF. HTPBE? flags the edit made after issuance.
Letter authored from scratch with lifted signature
No real letter exists. Borrower builds one in Word using bank letterhead lifted from a public source, pastes a signature image lifted from another document or social media, exports as PDF. The pasted signature image can show signs of having been edited and re-saved before it was placed.
Same signature reused across ‘different’ donor letters
Multiple gift letters from supposedly different donors carry visually identical signatures – the signature image was recycled from one letter to the next and pasted in each time.
The scale
Why your existing checks miss this
VOD calls the bank. The donor letter has no bank to call.
Both layers matter. The PDF the borrower uploaded is what your underwriter signs off.
Deposit-confirmation (VOD) services call the bank to confirm the balance – useful for asset letters but not for gift letters from individual donors. Day 1 Certainty asset checks (Account Aggregation) require the borrower to connect the account; borrowers who fabricated the balance rarely consent. Manually checking with the donor is rare and slow. HTPBE? catches the asset / gift letter PDF the borrower uploaded at the moment of intake – standalone, no bank-side or donor consent required.
What HTPBE? checks
Detection capabilities
Deterministic structural signals. No probabilistic scores, no model training.
Pasted-signature detection
Pasted signatures and logos can show signs of having been edited and re-saved before they were placed – a structural indicator of fabrication or signature swapping.
Post-issuance edit detection
HTPBE? detects a letter that was edited after it was issued.
Bundled donor letters
When several gift letters from ‘different’ donors arrive in one file, HTPBE? checks the file as a whole and returns its verdict and named markers. Compare the signatures across the letters before accepting the set.
Dates that disagree
HTPBE? flags a modification date that differs from the declared creation date – a high-confidence flag for post-issuance editing on a ‘freshly signed’ letter.
A Word letter isn’t an all-clear
Asset letters legitimately come from bank document systems or from desktop tools (small-bank letters often originate in Word). A letter exported directly from Word, Excel or LibreOffice, with nothing indicating later editing, comes back INCONCLUSIVE – not INTACT – and goes to manual review; MODIFIED when the file itself carries evidence of editing or fabrication.
Pages from different sources
HTPBE? detects documents assembled from pages of different sources – a structural sign of post-issuance editing.
Share with engineering
Wire this into your intake pipeline in under a day
Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.
Pricing
Self-serve plans, no sales call
All plans include the same forensic checks. Pick the quota that matches your monthly document volume.
manualStarter
30 credits/mo
Manual spot-checks and integration testing
most commonGrowth
350 credits/mo
Active document processing pipelines
high volumePro
1,500 credits/mo
High-volume automation and API integrations
Enterprise (unlimited, on-premise available) — see full pricing
API key on signup. Free test environment on every plan. No card required.
Customer Stories
Teams that stopped document fraud
Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.
Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.
Sarah M.
AP Manager
United States
We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.
Lars V.
Risk Analyst, Online Lending
Netherlands
Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.
Priya K.
HR Operations Lead
India
Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.
Julien R.
Fraud Analyst, Fintech
France
Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.
Marta S.
Compliance Coordinator
Spain
One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.
Tariq A.
Finance Manager
United Arab Emirates
FAQ
Frequently asked questions
Won’t a real Word-authored asset letter from a small bank look ‘fake’ too?
inconclusive – not intact – and should go to manual review, not be treated as proof of fraud. The verdict is modified when the file itself carries evidence of editing or fabrication, such as a lifted signature or an edit made after creation.Does this work for Deposit-confirmation (VOD) PDFs?
modified, the same as any other bank letter. One typed up in Word, Excel or LibreOffice and exported directly, with nothing indicating later editing, comes back inconclusive – not intact – however closely it copies the bank’s layout, and should go to manual review.Can it detect a recycled donor signature across multiple gift letters?
Does this replace manually checking with the donor?
What does an INCONCLUSIVE verdict mean for an asset or gift letter?
status_reason says which. For asset and gift letters, INCONCLUSIVE is the expected baseline for this document type rather than an automatic fraud signal. Combine INCONCLUSIVE with your own checks – issuer confirmation, comparison against other documents from the same source – before flagging. INCONCLUSIVE alone on an asset or gift letter is a prompt for manual review, not a red flag.Secure your workflow
Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.