logo
Experience letter fraud

Fake Experience Letter Detection – Catch Forged Proof

Built for fraud ops at lending, insurance & compliance teams

A fabricated experience letter looks identical to a real one – until you read the file structure. Talent ops teams, BGV operators, and visa sponsors all face the same pattern: a candidate cannot prove four years at a previous employer, so they author a letter in Microsoft Word, sign it themselves, export to PDF, upload. Visual review passes. Structural analysis does not.

~3 sec
per document
63 checks
forensic layers
1,500+
docs / month on Growth
Plans
subscriptions or one-off packs – see pricing
Scope

HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally fabricated or tampered experience letter, we’re the most specific tool for it.

When HTPBE? returns INCONCLUSIVE on an experience letter, that’s the expected baseline (these documents legitimately come from desktop tools at small employers); combine with other markers before flagging.

The problem

Modern document fraud is invisible to visual review

A growing class of document fraud opens a genuine PDF, edits a balance, a date, or a beneficiary, and re-saves it. Visually nothing changes – the document passes pixel-level review, layout review, and KYC.

Structural PDF analysis reads the layers rendering engines never expose: revision history, object structure, signature coverage maps. That is where edits leave fingerprints they cannot wipe.

Common tampering patterns

  • Modified balances or totals after export
  • Swapped IBAN or beneficiary on invoices
  • Post-signature edits on contracts
  • Backdated issue and modification dates
  • Fabricated documents from consumer PDF tools

What this looks like

How fake and tampered experience letters actually look

Three real fraud mechanics we catch at the structural PDF layer.

01

Letter authored in Microsoft Word from scratch

No previous employer involved. The candidate writes the letter in Word using the company’s logo lifted from LinkedIn, signs the HR Manager’s name, exports to PDF. However closely it copies the company’s letterhead, the file does not come back INTACT: with nothing indicating later editing it returns INCONCLUSIVE and should go to manual review; with evidence of editing or fabrication, MODIFIED.

02

Real letter with edited dates or salary

An applicant has a genuine letter from a brief stint, but the dates or compensation don’t support the role they’re applying for. They open the PDF in Adobe Acrobat or an online editor, change the dates from ‘Jan 2022 – Aug 2022’ to ‘Jan 2020 – Aug 2024’, re-export. HTPBE? flags the edit made after issuance.

03

Signature lifted and pasted

A signature image cropped from another document and pasted onto a fabricated letter. HTPBE? flags the pasted signature.

The scale

~1 in 8
job applicants misrepresent prior employment on background checks
$17K+
average cost to replace a fraudulent hire
~3 sec
per experience letter via API

Why your existing checks miss this

BGV calls the employer. It does not inspect the file.

Both layers matter. The employer call only works if they pick up.

BGV platforms (AuthBridge, IDfy, OnGrid, Springworks) call the previous employer to confirm employment dates and role. This works when the employer responds – but Indian BGV failure rates on previous-employment checks routinely run 15–30% (employer non-response, defunct companies, HR-team turnover). When that check cannot be completed, candidates fill the gap with a letter. HTPBE? catches the file the candidate sent, regardless of whether the previous employer responds. Use both: BGV for the fact when reachable, HTPBE? for the file always.

Results in under 3 seconds30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Hand-built letters go to review

An experience letter typed up in Word, Excel or LibreOffice and exported by hand does not come back INTACT, however closely it copies the employer’s letterhead. With no sign of later editing it returns INCONCLUSIVE for manual review; with evidence of editing or fabrication, MODIFIED.

Pasted letterheads and logos

HTPBE? detects company logos and letterheads lifted from another document and pasted in – a structural fingerprint of fabrication.

Signature tamper detection

Many large employers digitally sign experience letters via DocuSign, Adobe Sign, or HelloSign. Editing a signed letter after signing, or stripping its signature, is among the things HTPBE? looks for in the file.

Post-issuance edit detection

HTPBE? detects an experience letter edited after issuance – whether it was changed in a PDF editor or rebuilt in other software.

Pasted-signature detection

HTPBE? detects signatures dropped in from another document, including signature images that were edited and re-saved before they were placed.

Dates that disagree

HTPBE? flags a modification date that differs from the declared creation date – a common sign of a hand-edited letter.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

What about letters from genuinely small employers who use Word for everything?

Small employers do exist and may legitimately export from Word. A letter written in Word is not a verdict on its own – HTPBE? combines the file’s origin with other evidence in the file, such as signature state and recorded dates. When nothing else points to editing, the result is typically inconclusive – a prompt for a manual check with the employer rather than an automatic reject.

How is this different from BGV employment checks?

BGV calls the previous employer to confirm employment. HTPBE? inspects the file the candidate uploaded. They are complementary – and HTPBE? works even when BGV cannot reach the previous employer (which fails 15–30% of the time in Indian BGV operations). Search ‘experience verification letter’ or ‘verification of work experience letter’ and you are usually asking both at once: did this person really work there (the employer call), and was the letter PDF itself edited after it was issued (the file check). HTPBE? answers the second. It tells you whether the document was tampered with, not whether the employment claim is true.

Can it catch backdated letters where the dates were edited?

Yes. When the dates on a real letter are edited, HTPBE? flags the edit made after issuance – typically a modified verdict with named markers, even when the visual layout looks clean – and your reviewer can see the file was changed after issuance.

What if the candidate provides a photo of a printed letter instead of the PDF?

A phone photo is not a PDF, so it is outside scope. Always require the original PDF from the previous employer. If the candidate cannot provide it, treat that as a separate signal.

What does an INCONCLUSIVE verdict mean for an experience letter?

HTPBE? returns INCONCLUSIVE when an experience letter PDF was authored on a desktop and nothing in the file points to later editing. For an experience letter, INCONCLUSIVE is the expected baseline rather than an automatic fraud signal – small and mid-size employers legitimately author these letters in Word or Google Docs, and a clean single-session export is normal. Combine INCONCLUSIVE with the other markers HTPBE? returns (image-stream artefacts, modification timestamp) before flagging. INCONCLUSIVE alone on an experience letter is a prompt for a manual check with the employer, not an automatic red flag.

Does HTPBE? detect fake experience certificates as well as experience letters?

Yes – ‘experience certificate’ and ‘relieving letter’ are the Indian-vocabulary forms of the same proof-of-employment document, and HTPBE? checks any of them exactly the same way. We don’t care what the document is titled; we look at whether the PDF was fabricated or edited after the employer issued it – evidence of editing after issuance, a pasted signature or logo image – and a letter typed up in office software is not passed as an untouched original. Drop any experience certificate or relieving letter into the free check above to see the verdict, or sign up to run them automatically through the API.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →