How to spot fake documents

Featured Image

Unsurprisingly, the documents most frequently requested in fintechs' digital onboarding processes are also some of the most frequently fraudulent. But knowing the most common document forgeries to look out for—and how document fraud detection solutions expose them—goes a long way toward fighting document fraud in your business.

Summary

    How to spot a fake ID

    Since they are the foundation of most know your customer (KYC) onboarding processes, it's crucial to be able to detect fake ID cards like driver's licenses or passports. One of the primary ways fraudsters manipulate IDs is through image doctoring, altering the photo, name, or other details on the ID itself. This can be quite crude: it's often evident when words have been inserted or an all new photo has been imported into the image file. These types of modifications usually leave traces in the image metadata as well as in image attributes that don't match across different portions of the card.

    These are not "real" fake IDs that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

    These are not "real" fake IDs that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

    Stolen IDs being reused unaltered or IDs that have undergone pre-digital modification, meanwhile, can present problems for more traditional fraud detection software. However, these are often given away by noting image similarities across a collection of images. A recurring background is usually a dead giveaway: the same person taking the same type of photos in the same place. Even if the fraudster is clever and uses different backgrounds, then lighting, portions of the image that match characteristics seen elsewhere, and attributes of the device that has uploaded the photo will trip up a fraudster.

     ID_changing_bg


    These are not "real" fake IDs that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

    How to spot a fake proof of address

    Proof of address can present a problem for traditional fraud detection: fake utility bills, manipulated bank statements, or fake Social Security awards letters might all crop up. Keeping up to date with every possible issuing authority simply isn't possible, especially for multinational businesses dealing with customers all over the world. But the documents that can be used as proof of address are also usually straightforward, and so are frequently made from scratch by unskilled forgers or template farms.

    However, making something "close enough" to the real deal ignores the actual complexity contained within the genuine articles.

    For instance, some proof of address documents crop up frequently, such as documents from major energy companies and large banks. It's easy to compare incoming documents to templates created from examples already confirmed as genuine, so logo detection that flags out-of-date designs or page layouts inconsistent with real documents commonly outs attempts to fake proof of address.

    For documents that are less common or that attempt to alter real examples, minor qualities that can go unnoticed by humans—like copy-pasted letters or inconsistent image qualities—can certainly point to a fraudulent document.

    Germany-cropped 


    These are not "real" fake proofs of address that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

    How to spot a fake bank statement

    Bank statements are important tools for confirming proof of funds, proof of income, and proof of address, especially for online lenders aiming to carry out the underwriting process. Skilled fraudsters will probably skip outright document forgery and will instead choose to edit PDF versions of bank account statements—these can easily be found online or downloaded from an email or banking app. While the altered end product may be outwardly pretty convincing to a human reviewer, this approach leaves an obvious technological trail that the file has undergone unauthorized changes.

    In addition to the logo detection and image attributes mentioned above, these attempts at creating fake bank statements also leave "fingerprints" in the metadata of the files themselves. Anything from timestamps of changes to the document to records of a file passing through a program different from the one known to be used by the issuing bank—as well as potentially dozens of other small details—can be the difference between a real bank statement and an illegitimate one. Again, these differences won't always be caught by the naked eye and require a forensic analysis of the file in question.

    BOA-cropped

    These are not "real" fake bank statements that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

    How to spot a fake W2

    W2 forms come into play during tax season as well as when lenders and government services need to verify proof of employment and other personal details. Fraudsters often present fake W2s to inflate their income, resulting in the ability to be approved for loans or interest rates they aren't qualified for or which they never intend to pay back at all.

    Fake W2s and other very common standardized forms might seem like easy targets for forgery and manipulation, but their consistency actually helps catch underhanded dealings. If certain fields don't align with the rest of the form or non-standard fonts appear, there's a good chance that you're dealing with a fake form.

    How to spot fake stubs

    Pay stubs and tax forms also have a trick up their sleeves when it comes to metadata. Businesses both large and small typically rely on accounting software to generate these all-important records. When generated digitally, genuine files produced by bookkeeping programs leave specific markers. Quality fraud detection software uses these to note whether a bookkeeping program was the originator of a given file and whether any alterations have occurred between the time of output and the time the document is submitted to the service requesting a copy. If one of these checks turns up something unexpected, a fake pay stub or a fake tax document is very possible.

    It's important to note that metadata inconsistencies alone aren't proof of a fraudulent document; cross-checks with other analyses—in our case over 500 different detectors—usually tabulate a long list of evidence that indicates a high likelihood of document fraud.

    How to spot fake merchant onboarding materials

    Merchant onboarding or know your business (KYB) can carry even higher stakes than KYC onboarding processes: penalties for doing business with inappropriate figures can be higher, more overlapping jurisdictions might come into play, and losses for the SME lenders themselves are often much larger. Fake merchant onboarding materials like certificates of incorporation or business licenses can have the added complication of containing information from many localities and obscure institutions, sometimes in languages and government structures most review teams aren't well versed in.

    However, uncovering what is and isn't valid doesn't always require assembling expensive teams of specialists or reaching out to overloaded civil servants: again, a forensic look at the documents a business provides can reject many instances of attempted fraud right away. Completely agnostic of language or nationality, fraudulent merchant onboarding materials can suffer from any of the problems noted above: variations in image qualities, font inconsistencies, and reused images can all be present here. In fact, attributes unique to business documents such as digitally added official stamps or notarizations can offer even more opportunities to find attempts at faking documentation.

    Marrakesh

    These are not "real" fake merchant onboarding materials that we have detected; they are recreations based on the fraud techniques described above and are for illustrative purposes only.

     

    Matt Jones, Content Manager