Free PDF Check

Stop BEC Invoice Fraud – Detect Vendor-Impersonation Tampering

Q: Can it detect if just the bank account number was changed?

HTPBE does not perform visual content analysis – it does not read text and compare specific values. What it detects is structural evidence that the PDF was modified after it was created. An edit made in an ordinary PDF editor typically leaves that kind of evidence, and BEC usually means an attacker editing a real vendor invoice.

Q: How do I add this to our invoice approval workflow?

The HTPBE API accepts a PDF URL and returns a JSON response with a verdict and modification markers. It can be called from your ERP, AP automation platform, or a simple webhook integration. Free test keys are available on all plans, so your team can build and test the integration before committing to a paid plan. The Starter plan covers 30 checks; the Growth plan covers 350 checks – suitable for most mid-market AP volumes. See pricing for current rates.

Q: What if the invoice was created in Word?

HTPBE works on any PDF regardless of the original application. An invoice comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. INCONCLUSIVE means HTPBE cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

Built for fraud ops at lending, insurance & compliance teams

HTPBE? is a REST API that catches the BEC vendor-impersonation pattern: a real invoice from a real vendor, intercepted in transit, with one field changed – the IBAN, the SWIFT/BIC, the wire-routing line, the beneficiary name. Every other check downstream still passes; the structural fingerprint of the editing session does not. In a business email compromise attack, the vendor name, amount, and invoice number are all legitimate. Only the payment destination changed. That single edit leaves a forensic trace HTPBE? finds before the wire goes out.

~3 sec

per document

forensic checks per document

1,500+

docs / month on Growth

Plans

subscriptions or one-off packs – see pricing

The problem

Modern document fraud is invisible to visual review

A growing class of document fraud opens a genuine PDF, edits a balance, a date, or a beneficiary, and re-saves it. Visually nothing changes – the document passes pixel-level review, layout review, and KYC.

Structural PDF analysis reads the layers rendering engines never expose: revision history, object structure, signature coverage maps. That is where edits leave fingerprints they cannot wipe.

Common tampering patterns

Modified balances or totals after export
Swapped IBAN or beneficiary on invoices
Post-signature edits on contracts
Backdated issue and modification dates
Fabricated documents from consumer PDF tools

What this looks like

How BEC fraud lands a tampered invoice on your AP queue

Three real fraud mechanics we catch at the structural PDF layer.

IBAN swap – an edit made after the vendor’s export

The BEC operator opens the genuine vendor invoice in a desktop PDF editor (Acrobat, Foxit, an online editor) just long enough to overtype the IBAN and re-export. An edit like this typically leaves traces in the file’s structure even though every visible field still looks right, and those traces are what a MODIFIED verdict rests on.

Last-minute beneficiary-name swap on a real-vendor invoice

Some BEC variants change only the beneficiary-name line under the IBAN to a similar-looking entity (‘Acme Holdings Ltd’ instead of ‘Acme Ltd’). Visual review treats it as the same vendor; the editing session still leaves structural evidence that the file was modified after creation, and HTPBE? returns it as a named marker.

Modified after the vendor issued it

When the file shows it was modified after it was first created, it was touched after it left the vendor – a direct in-transit-tampering signal.

Vendor digital signature stripped or invalidated

Some accounting platforms sign invoices on export. The BEC editor cannot keep the signature valid after editing, and in many cases the attacker simply strips it. HTPBE? returns certain-confidence markers when content changed after signing or a signature was stripped after signing.

Forensic checks per document

~3 sec

Median analysis time, end to end

Why 4-eye approval is not enough

What 4-eye approval misses, and where structural detection catches the IBAN swap

Two reviewers checking that an invoice looks right will both miss the same edit when only the IBAN changed.

AP automation, dual-approval workflows, and vendor master-data validation all check the metadata around the invoice – vendor name, amount, PO match, approver hierarchy. None of them open the PDF binary and check whether one field was edited mid-flight. A BEC operator does not change the amount or the vendor – both reviewers see the right vendor and the right amount, sign off, and the wire fires to the attacker IBAN. Structural-PDF analysis catches the editing-session fingerprint that the visual review and the metadata check both pass.

Results in under 3 seconds·30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Stated origin contradicted

The file’s structure contradicts the origin it states – a common sign of editing after export.

Post-creation edits

Detects documents that were changed and saved again after they were first produced, and reports them with a named marker.

Pages from multiple sources

Documents assembled from pages of different files – a page swapped in from another statement, a forged page spliced into a genuine pack.

Date inconsistencies

Creation and modification dates that contradict each other, or dates that could not be real. Either is a sign the file changed after it was issued.

Digital signature validation

When a document is digitally signed, HTPBE? checks whether it changed after signing or had its signature removed. Either finding returns a certain-confidence verdict.

Replaced or overlaid text

Detects text replaced or added on a page after the document was produced – without relying on how the page looks on screen.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflow View API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document – it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

How do BEC invoice attacks actually work?

Business email compromise invoice fraud typically works in one of two ways. In the first, attackers compromise or spoof a vendor’s email account, intercept an outgoing invoice, edit the bank account details in the PDF, and resend it from the vendor’s address. In the second, attackers impersonate a vendor entirely and send a fabricated invoice with their own banking details. In both cases, the amount, vendor name, and invoice number are legitimate – only the payment destination has changed.

Can it detect if just the bank account number was changed?

HTPBE? does not perform visual content analysis – it does not read text and compare specific values. What it detects is structural evidence that the PDF was modified after it was created. An edit made in an ordinary PDF editor typically leaves that kind of evidence, and BEC usually means an attacker editing a real vendor invoice.

How do I add this to our invoice approval workflow?

The HTPBE? API accepts a PDF URL and returns a JSON response with a verdict and modification markers. It can be called from your ERP, AP automation platform, or a simple webhook integration. Free test keys are available on all plans, so your team can build and test the integration before committing to a paid plan. The Starter plan covers 30 checks; the Growth plan covers 350 checks – suitable for most mid-market AP volumes. See pricing for current rates.

What if the invoice was created in Word?

HTPBE? works on any PDF regardless of the original application. An invoice comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it. INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud Gap See Pricing

Read API Docs →