logo
Medical bill fraud

Medical Bill Tamper Detection – Catch Edited Bills

Built for fraud ops at lending, insurance & compliance teams

A medical bill PDF can be edited to add a line, change an amount, or invent a procedure – and most insurance reviewers will not notice. Insurance claims adjusters and SIU teams see medical bills attached to most health and disability claims. Expense reimbursement reviewers process medical-related receipts in T&E. Lenders accept medical bills as supporting documents in hardship requests. The fabrication paths are well-known to fraudsters – and the visual layout is convincing enough to pass review.

~3 sec
per document
63 checks
forensic layers
1,500+
docs / month on Growth
Plans
subscriptions or one-off packs – see pricing
Scope

HTPBE? analyzes the structural layer of the PDF file – the layer that records every edit, even invisible ones. We don’t inspect holograms, phone photos, or ID biometrics. If your fraud problem is a digitally altered or fabricated medical bill, we’re the most specific tool for it.

When HTPBE? returns INCONCLUSIVE on a medical bill, that is a reason to escalate to manual review, not proof of fraud – it means HTPBE? cannot confirm the file as an untouched original.

The problem

Modern document fraud is invisible to visual review

A growing class of document fraud opens a genuine PDF, edits a balance, a date, or a beneficiary, and re-saves it. Visually nothing changes – the document passes pixel-level review, layout review, and KYC.

Structural PDF analysis reads the layers rendering engines never expose: revision history, object structure, signature coverage maps. That is where edits leave fingerprints they cannot wipe.

Common tampering patterns

  • Modified balances or totals after export
  • Swapped IBAN or beneficiary on invoices
  • Post-signature edits on contracts
  • Backdated issue and modification dates
  • Fabricated documents from consumer PDF tools

What this looks like

How fake and tampered medical bills actually look

Three real fraud mechanics we catch at the structural PDF layer.

01

Real medical bill edited to add line items

Authentic medical bill from a clinical billing system. The patient or claimant downloads it, opens it in any PDF editor, adds a procedure line or bumps an existing amount, exports as PDF. The edit typically leaves traces of the editor in the file – structural evidence of post-issuance editing.

02

Medical bill fabricated in Word from a template

A medical-bill-shaped PDF authored in Word using a clinic letterhead lifted from a public source, populated with a desired diagnosis, CPT code, and amount, exported. However closely it copies the clinic’s layout, the bill comes back MODIFIED when the file itself carries evidence of editing or fabrication, whatever tool produced it; one HTPBE? cannot confirm as an untouched original should go to manual review.

03

Multiple ‘office visit’ bills aggregated to inflate annual claim

Several bills claiming different visit dates are produced in one session to inflate an annual hardship or claim. Lining up the creation timestamps the API returns for each file reveals that ‘five different visits’ all generated PDFs within minutes of each other.

04

Patient, provider or date details swapped on a genuine bill

A real bill issued to someone else, or for a different visit, is reopened and the patient name, provider details or date of service are replaced so it fits the claim. The totals stay untouched, which is why a quick read of the amounts raises no flag.

05

Totals edited without touching the line items

Only the balance due or the amount paid is changed, so the line items and the total no longer agree. A reviewer who checks the arithmetic may catch it; a reviewer who skims the summary box will not.

The scale

$308B+
lost to insurance fraud globally each year
10–15%
of all claims involve some form of document fraud
~3 sec
per medical bill via API

Why your existing checks miss this

Claims-platform OCR reads what the bill shows. It does not check the file.

And calling the provider to check is slow and partial.

Claims platforms (Guidewire, Duck Creek, Origami) and OCR-based bill processing tools extract data and apply rules – they do not check whether the underlying PDF was edited after it was issued. Provider fraud detection (calling the clinic to confirm) works but is slow and impractical for high-volume claims. SIU teams investigate downstream, after the claim has already moved through. HTPBE? catches the medical bill PDF the claimant uploaded at the moment of intake – standalone, no EHR integration, no provider call required.

Results in under 3 seconds30 to 1,500+ documents/month

What HTPBE? checks

Detection capabilities

Deterministic structural signals. No probabilistic scores, no model training.

Built to look right, judged on the file

However closely it copies a clinic’s billing layout, a bill is not passed on looks. INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud.

Post-issuance edit detection

Editing a medical bill after issuance – in a PDF editor or in other software – leaves structural evidence behind. HTPBE? flags it as MODIFIED.

Character overlay on the original

Altering a line item on an existing bill leaves a structural trace. HTPBE? flags it without reading the amounts – it never looks at the figures on the page.

Dates that disagree

When the dates recorded inside a ‘freshly issued’ bill disagree with each other, HTPBE? flags it – a high-confidence sign of editing after export.

Side-by-side review of bill sets

When multiple ‘office visit’ bills arrive together, HTPBE? returns a verdict and named markers for each file. Reviewing the results side by side helps SIU spot sets that were fabricated or edited the same way.

Pasted-element detection

Fabricated bills often paste clinic logos lifted from public sites. HTPBE? detects logos, signatures and headers lifted from another document and pasted in.

Share with engineering

Wire this into your intake pipeline in under a day

Two API calls – one POST to submit the PDF, one GET to retrieve the verdict. Forward this page to your engineering team; the full API reference, quotas, and copy-paste examples in cURL, JavaScript, Python, PHP, Go, and Ruby are one click away.

Full API reference for engineering

Pricing

Self-serve plans, no sales call

All plans include the same forensic checks. Pick the quota that matches your monthly document volume.

manual

Starter

30 credits/mo

Manual spot-checks and integration testing

most common

Growth

350 credits/mo

Active document processing pipelines

high volume

Pro

1,500 credits/mo

High-volume automation and API integrations

Enterprise (unlimited, on-premise available) — see full pricing

Secure your workflowView API docs

API key on signup. Free test environment on every plan. No card required.

Customer Stories

Teams that stopped document fraud

Compliance, finance, and risk teams use HTPBE? to catch manipulated PDFs before they become costly mistakes.

Caught an invoice where the total had been changed by less than a thousand dollars. Without this I would have approved it without a second look.

Sarah M.

AP Manager

United States

We had three applicants in the same week with bank statements that looked completely fine. Two of them were flagged as modified. You simply cannot see this by reading the document — it is in the file structure.

Lars V.

Risk Analyst, Online Lending

Netherlands

Salary slips were coming with altered figures. We identified two problematic files before the placement was finalised.

Priya K.

HR Operations Lead

India

Since we started checking documents this way, we stopped two applications early in the process that would have been very difficult to reverse later.

Julien R.

Fraud Analyst, Fintech

France

Some applicants were sending PDFs that looked authentic but had been edited in ways not visible to the eye. We now ask for checked originals when something is flagged. Already saved us from a few bad decisions.

Marta S.

Compliance Coordinator

Spain

One invoice was caught because there was a mismatch between the document dates and structure. That particular case would have cost us significantly.

Tariq A.

Finance Manager

United Arab Emirates

FAQ

Frequently asked questions

Does this work with bills from any EHR or clinical billing system?

Yes. The analysis is producer-agnostic – it inspects whichever PDF the claimant submits. It works on bills from Epic, Cerner, athenahealth, Allscripts, NextGen, eClinicalWorks, Greenway, Practice Fusion, and other major and small EHR systems. Re-saving a bill in an editor after export leaves traces HTPBE? flags.

How is this different from claims-platform OCR or VRF (Vendor Recovery)?

OCR-based bill processing extracts data; HTPBE? inspects file structure. VRF and downstream recovery happens after the claim moves through. HTPBE? catches the file at intake, before adjuster review. Use all three: OCR for data, HTPBE? for file integrity, VRF for downstream recovery.

Can it catch medical bills generated by AI tools?

A medical bill comes back modified when the file itself carries evidence of editing or fabrication, whatever tool produced it. An inconclusive result means HTPBE? cannot confirm the file as an untouched original – a reason for manual review, not proof of fraud. Checking with the provider is a sensible next step. For deeper treatment of AI-generated documents, see /use-cases/ai-generated-document-detection.

What does an INCONCLUSIVE verdict mean for a medical bill?

INCONCLUSIVE means HTPBE? cannot confirm the file as an untouched original. For medical bills, INCONCLUSIVE is a review trigger: it is not evidence of fraud, and it is not a pass. Route the case to provider fraud detection or SIU review before claim payout.

Who reviews medical bills, and where does the check fit?

Three groups handle most of them: claims handlers and SIU teams at health, travel and disability insurers; reimbursement reviewers at employers and benefits administrators; and lenders or landlords who accept a medical bill as proof of a hardship. In each case the bill arrives as a PDF upload, so the natural place for the check is intake – before the file is attached to the claim or sent to a reviewer.

Which edits does the check look for on a medical bill?

The typical ones: a changed total or balance, an added or removed line item, a different date of service, and swapped patient or provider details. HTPBE? does not read these fields. It reports whether the PDF file shows signs of having been edited after it was issued, and which of the public checks fired.

Does a modified verdict mean the bill is fraudulent or medically wrong?

No. A modified verdict is evidence that the file was changed after issuance. It says nothing about whether the treatment happened, whether the codes are correct, or why the file was changed – a clinic may re-issue a corrected bill, and an assistant may re-save a file for legitimate reasons. Use the verdict to decide what to ask the claimant or provider for next.

What if the claimant sends a scan or a phone photo of the bill?

A scanned or photographed bill has no issuing system behind it, so it can never return an intact verdict. Treat it as a request for the original: ask the claimant for the PDF the provider or portal issued, or confirm the bill directly with the provider.

What does an intact verdict on a medical bill tell me?

That the file shows no sign of being edited after it was produced. It does not confirm the charges, the diagnosis or the identity of the patient, and a bill can be wrong or fabricated at the source without any later edit. Pair it with your usual provider and coverage checks.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →