logo
Free PDF Check

Fake Medical Certificate Detection API

Built for fraud ops at lending, insurance & compliance teams

Detect sick notes, doctor’s notes, and fitness-to-work certificates that were edited after a clinic issued them. One API call reads the PDF’s own structure and returns forensic evidence of post-issuance modification — at intake, before a claim is paid or an absence is approved.

~3 sec
per document
63 checks
forensic layers
From $15
per month
1,500+
docs / month on Growth
Scope

HTPBE? analyzes the structural layer of the PDF file — the layer that records every edit, even invisible ones. We do not verify whether the person was actually ill, whether the diagnosis is real, whether the issuing practice or doctor is licensed, or whether anything written on the certificate is true. We answer one narrow question: does this file show evidence of having been written to after it was issued? Medical facts and practitioner registration are a separate check, and we do not replace them.

What a verdict is worth depends on how the certificate reached you. A PDF exported directly by a clinical or practice-management system can earn INTACT, and a digital signature from the practice makes INTACT a strong indicator. A paper note that the employee scanned or photographed can never be INTACT — INCONCLUSIVE is the ceiling for scans, and on this document type scanned notes are the normal case, not a red flag. Treat INCONCLUSIVE on a scan as the expected baseline; treat it on a document that claims to be a direct clinical export as a reason for manual review.

The problem

A real sick note, edited after it was issued, prints identically

The common sick-note fraud is not a document invented from nothing. It is a genuine certificate that a real clinic issued — for two days, for last month, for a colleague — reopened in a PDF editor or a word processor and saved again with a different date, a different name, or a longer absence period. Nothing about the page betrays it. The letterhead is real, the layout is real, the stamp is real, because they came from a real document.

Claims teams and HR administrators review these documents on screen. Screen review cannot see an edit that leaves no visual trace, and it cannot compare a submission with an original that the reviewer has never held. Neither can OCR: extracting the text tells you what the file says now, not whether it said something else when the clinic produced it.

The file itself keeps a record. A PDF is not overwritten when it is edited — the writing tool appends, leaving a second cross-reference table, an incremental-update record, and a producer signature belonging to the tool that did the writing rather than the system that issued the document. HTPBE? reads that record directly from the binary structure and reports what it finds, with named markers, in about three seconds.

Common sick-note and fitness-to-work fraud patterns

  • Absence period extended — the end date pushed out by days or weeks
  • Dates moved so an old certificate covers a recent absence
  • Patient name replaced with the name of the person submitting it
  • Diagnosis or restriction text rewritten to support a disability claim
  • A fitness-to-work clearance edited to remove stated work restrictions
  • Clinic letterhead lifted from a genuine note and reused on a fabricated one
  • Pages taken from several documents and assembled into one certificate

What this looks like

Document fraud in 2026 — three concrete patterns

Three real fraud mechanics we catch at the structural PDF layer.

01

Absence period extended — the end date pushed out by days or weeks

02

Dates moved so an old certificate covers a recent absence

03

Patient name replaced with the name of the person submitting it

04

Diagnosis or restriction text rewritten to support a disability claim

05

A fitness-to-work clearance edited to remove stated work restrictions

06

Clinic letterhead lifted from a genuine note and reused on a fabricated one

07

Pages taken from several documents and assembled into one certificate

63 layers
Forensic checks per document
~3 sec
Median analysis time, end to end
From $15
Self-serve per month, no sales call

The detection gap

KYC platforms check the document. HTPBE? checks the file.

Two different checks — both matter.

KYC & identity platforms

Plaid · Persona · Alloy · Jumio

  • Is this a real bank statement template?
  • Does the account number match the identity?
  • Is the document format consistent with the issuing bank?

Detects fake documents. Does not detect edited real documents.

HTPBE? tamper detection API

Structural PDF integrity

  • Was this specific PDF file modified after it was generated?
  • Do metadata timestamps match the file structure?
  • Were digital signatures valid at the time of signing?

Catches edits invisible to visual review and template checks.

Results in under 3 seconds30 to 1,500+ documents/monthFrom $15/mo

What HTPBE? checks

Forensic signals analyzed in every medical certificate

Five layers of structural analysis — results in under 3 seconds

Multiple xref tables

A PDF exported once by a clinical system carries a single cross-reference table. A second table means content was appended after that first save — the primary structural marker that a document was written to after issuance.

Incremental update chain

Each editing session appends an incremental update record rather than rewriting the file. HTPBE? measures the length of that chain. A certificate carrying two or more updates passed through an editing tool after the clinic produced it.

Producer and creator mismatch

Certificates issued by a practice come out of clinical document systems and carry their producer signature. A producer field naming a consumer PDF editor or an office word processor tells you which tool last wrote the file — it does not belong on a document that claims to be a direct clinical export.

Modification date after the creation date

The ModDate field updates automatically whenever a file is written. A ModDate later than the file’s own CreationDate establishes that the document was written to after it was first produced, whatever the reason for the edit. The comparison is between two fields inside the file — it does not depend on any date printed on the page.

Signature removal and post-signature edits

Where a practice signs certificates digitally, HTPBE? detects both content changed after signing and a signature block that was stripped out before re-submission. Both return “certain” confidence — the highest verdict level we issue.

Multi-session page assembly

HTPBE? compares how the pages of a document were rendered. Pages that originate from different rendering sessions or different source files indicate a document assembled from parts rather than exported once by a single system.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls — one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

$15/mo

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

$149/mo

350 credits/mo

Active document processing pipelines

high volume

Pro

$499/mo

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

Which medical certificate types can be checked?

Any PDF issued to certify illness, absence, or fitness: sick notes and doctor’s notes, fit notes and fitness-to-work certificates, return-to-work clearances, sick-leave and disability certificates, and medical restriction letters. The analysis reads the PDF binary structure and is indifferent to what the document says it is, so it works on any certificate regardless of country, language, or issuing practice. Medical bills and invoices are a different document type — those are covered by medical bill tamper detection.

Can you verify that the doctor or clinic on the certificate is real?

No, and we will not imply otherwise. HTPBE? analyzes the structure of the PDF file. It does not check medical registers, contact practices, confirm that a practitioner is licensed, or assess whether a diagnosis is genuine. Those are identity and medical-verification questions and they need a different instrument — a practitioner register, a direct enquiry to the issuing practice, or an occupational-health assessment. What we contribute is narrower and independent of all of them: whether the file in front of you was written to after it was issued.

What does a “modified” verdict mean for a sick note?

It means the file contains structural evidence of post-issuance editing: an additional cross-reference table, an incremental-update record, a producer inconsistent with a clinical export, a modification timestamp later than the file’s own creation timestamp, or a removed signature block. It is a statement about the file, not about the person. It does not establish that the employee was not ill, that the certificate is forged, or that anyone acted dishonestly — a document can be re-saved for entirely innocent reasons, including being passed through a compression or redaction tool on the way to you. The correct response is to review the document and, where it matters, ask the issuing practice for a copy. It is not grounds for a disciplinary conclusion on its own.

Most of our sick notes are scanned or photographed. Does that change the result?

Yes, and it is important to read it correctly. A scanned or photographed document is a new file created from paper, so the structural record of the clinic’s original export no longer exists — the scan is a fresh document produced by a scanner, a phone app, or a print-to-PDF driver. HTPBE? therefore never returns INTACT on a scan; INCONCLUSIVE is the ceiling by design. Because employees commonly photograph a paper note, INCONCLUSIVE is the expected baseline for this document type and carries no adverse inference by itself. The verdict becomes informative where a certificate is supposed to have arrived as a direct clinical export: there, INTACT is meaningful, and a signature from the practice makes it a strong indicator.

Can you tell which field was changed — the dates, the name, the diagnosis?

No. HTPBE? reports that a file was written to after issuance, not which words changed. We read the structural layer — cross-reference tables, update chains, producer identity, timestamps, signature state, page assembly — and none of that is tied to a particular sentence on the page. Anyone claiming to show you the previous value of a field from a PDF alone is over-reading the evidence. What you get is a defensible statement that the document is not the file the issuer produced, plus the named markers that support it; establishing what was changed means comparing it against the issuer’s own copy.

How does this fit into an HR absence or claims workflow?

The natural integration point is intake — the moment an employee uploads a certificate to an absence portal, or a claimant attaches one to a disability or sick-leave claim. Send the PDF URL to POST /v1/analyze, read the verdict from GET /v1/result/{id}, and route anything returning modified into a manual review queue rather than into an automated decision. The call adds under three seconds, and the returned id can be stored against the absence or claim record as an audit trail. Given that certificates are health-related documents, we recommend a human reviews every flagged case before any action is taken, and that a verdict never triggers an automatic decision about a person.

What about a certificate generated from scratch by an AI tool or a template site?

A file fabricated in one pass and never edited afterwards has no post-issuance edit to find, so it will often come back inconclusive rather than modified — HTPBE? detects modification, not invention. The metadata is still informative: the producer and creator fields name the tool that built the file, and a document that presents itself as a clinical export while naming a generic PDF library or a browser rendering engine is a signal worth escalating. Treat that as a prompt to verify with the issuing practice, not as proof on its own.

Secure your workflow

Create your account — check PDFs on the web or with an API key, both ready on signup.
From $15/mo. No sales call. Cancel any time.

Start Free — Close the Structural Fraud GapSee Pricing
Read API Docs →