Document Fraud Detection

What is Document Fraud Detection?

Document Fraud Detection checks an uploaded file for signs that it was edited, forged, or generated by AI. It helps you find documents that need a closer look before you rely on the data in them.

The checks inspect the file itself: its metadata, edit history, digital signatures, fonts, hidden content, and pixels. They don't depend on a document's layout, so you can use them on invoices, receipts, pay stubs, tax forms, and other document types.

📘
How this differs from bank statement fraud checks
Fraud Detection for bank statements also analyzes extracted transactions, such as balances and repeated transactions. Document Fraud Detection doesn't read or validate the values on a document, so a document with an incorrect total and no signs of file tampering can still score as clean.

Supported files

File type	Extensions	Maximum size
PDF	`.pdf`	50 MB
Image	`.jpg`, `.jpeg`, `.png`	50 MB

Other file types, such as TIFF, aren't analyzed. Password-protected PDFs can't be analyzed, so remove the password before you submit the file.

Enable Document Fraud Detection

To turn on Document Fraud Detection for your account, contact your Docsumo account manager.

The Fraud Analysis toggle in a document type's settings applies to bank statement document types only.

Fraud report

Each document gets a report with these parts:

Name	Description
Risk Score (`risk_score`)	Overall score from 0 to 100. A higher score means more signs of tampering.
Risk Level (`risk_level`)	The label for the score: `clean`, `low`, `medium`, `high`, or `critical`.
Findings (`findings`)	Each signal that the checks found, with its severity and details.
Informational (`informational`)	Neutral observations that add no points, such as a valid digital signature.
Checks Passed (`checks_passed`)	Groups of checks that found nothing.
Check Errors (`check_errors`)	Checks that couldn't run. See Errors.

Risk score

The risk level comes from the risk score:

Risk Score	Risk Level	What it means
0-14	`clean`	No meaningful signs of tampering.
15-34	`low`	Weak signals that rarely need action on their own.
35-59	`medium`	Suspicious signals that can also appear in genuine documents.
60-79	`high`	Strong signs of tampering. Review the document manually.
80-100	`critical`	Very strong signs of tampering. Review the document manually before you accept it.

Each finding adds points based on its severity, up to a maximum of 100:

Severity	Points	What it means
High	25	Strong signal of tampering that warrants a manual review.
Medium	10	Suspicious, but can occur in genuine documents.
Low	3	Weak signal that's only useful alongside other findings.
Info	0	Neutral observation.

Some findings also set a minimum score, so a single finding can move a document to a higher risk level.

This scale is different from the Fraud Score and Authenticity Score on bank statements, so don't compare the two directly.

Findings

Each finding has these fields:

Field	Description
Check (`check`)	The name of the check. See Checks.
Severity (`severity`)	`high`, `medium`, or `low`. Findings with `info` severity are listed under Informational.
Detail (`detail`)	A plain-language explanation of what was found.
Pages (`pages`)	The page numbers where the signal was found.
Locations (`locations`)	The position of the signal on the page.

Pages and locations appear only when a signal can be tied to a part of the page. There's no position for document-wide checks, such as metadata or edit history.

For example, this is the report for a sample invoice whose total was edited with an online PDF tool. It has a Risk Score of 100 and a Risk Level of critical.

Check	Severity	Detail	Pages
`metadata_online_editor_detected`	High	An online PDF editing tool was found in the document metadata.
`incremental_update_no_signature`	High	The document has 2 revisions and no digital signature.
`structure_duplicate_objects`	High	Duplicate object numbers were found, which happens when content is injected into a file.
`content_stream_white_text`	High	White text was drawn on the page, which is a common way to hide original content.	1

Checks

PDFs and images go through different checks. These tables list the main checks, and each finding's detail explains what was found.

PDF checks

Check	Name	Description
Metadata	`metadata_date_inversion`	The creation date is later than the modification date.
	`metadata_future_date`	The modification date is in the future.
	`metadata_online_editor_detected`	The metadata names an online PDF editor.
	`metadata_producer_consumer_tool`	The file was created or saved with desktop software, such as a word processor.
	`metadata_producer_fraud_generator`	The file was produced with a PDF library often used to forge documents.
	`metadata_producer_mismatch`	The file's two metadata records name different producers.
	`metadata_stripped`	The creator and producer information is missing.
Edit history	`incremental_update_no_signature`	The file was saved again after it was created, with no digital signature.
	`incremental_update_multiple_revisions`	The file has several layers of edits.
	`linearized_pdf_modified`	A PDF optimized for web viewing was changed after it was optimized.
Digital signature	`signature_partial_coverage`	The signature doesn't cover the whole file, so content may have been added after signing.
	`signature_no_byte_range`	A signature field exists but doesn't define which content it signs.
	`signature_cert_expired`	The signing certificate has expired.
	`signature_cert_self_signed`	The signing certificate is self-signed.
	`signature_weak_digest_md5`	The signature uses the broken MD5 algorithm.
	`signature_weak_digest_sha1`	The signature uses the deprecated SHA-1 algorithm.
	`shadow_attack_unsigned_revision`	Content was changed in an unsigned revision after signing.
Hidden content	`hidden_content_white_rectangle_over_text`	A white shape covers existing text.
	`hidden_content_invisible_text`	The page contains white or invisible text.
	`content_stream_white_text`	White text was drawn on the page, which can hide original content.
	`hidden_content_freetext_overlay`	A text annotation sits on top of page content.
	`hidden_content_optional_layers`	The file contains hidden layers.
	`hidden_content_redaction_annotations`	A redaction wasn't applied, so the original content is still in the file.
Fonts	`font_size_inconsistency`	A font appears at slightly different sizes, which can point to an edited value.
	`font_kerning_anomaly`	Character spacing differs from the rest of the document.
	`font_editor_injected`	Generic fonts were added alongside the document's own fonts.
	`font_page_inconsistency`	Some pages use very different fonts from the rest of the document.
	`font_duplicate_subset_prefix`	Several font objects share a subset ID, which doesn't occur in genuine files.
	`font_subset_extra_chars`	An embedded font contains characters that aren't in the visible text.
Images and pixels	`image_full_page_coverage`	Some pages are full-page images and others aren't, which can mean pages were replaced.
	`image_low_dpi_screenshot`	Images have a low resolution, which is typical of screenshots.
	`image_mixed_dpi`	Images have very different resolutions, which suggests they came from different sources.
	`pixel_ela_elevated`	Parts of a scanned page show signs of being compressed again.
	`pixel_sift_copy_move`	Part of a scanned page was copied and pasted elsewhere.
	`pixel_noise_inconsistency`	Noise levels vary across a scanned page.
File structure	`structure_duplicate_objects`	Duplicate object numbers were found, which happens when content is injected.
	`structure_xref_offset_invalid`	The file's internal index points to the wrong locations.
	`structure_stream_length_mismatch`	The declared length of the content doesn't match its actual length.
	`structure_version_feature_mismatch`	The file uses features newer than the PDF version it declares.
	`structure_producer_style_mismatch`	The file's structure doesn't match the software that it claims produced it.
Form fields	`form_field_value_ap_mismatch_numeric`	A numeric form value differs from the value displayed on the page.
	`form_field_value_ap_mismatch`	A form value differs from the value displayed on the page.
Active content	`suspicious_javascript`	The file contains JavaScript.
	`suspicious_launch_action`	The file contains an action that can run an external program.
	`suspicious_embedded_files`	Other files are embedded in the PDF.

Image checks

Check	Name	Description
Pixels	`image_ela_elevated`	Parts of the image show signs of being compressed again. JPEG only.
	`image_sift_copy_move`	Part of the image was copied and pasted elsewhere.
	`image_clone_detected`	The image contains duplicate regions.
	`image_noise_inconsistency`	Noise levels vary across the image, which suggests combined content.
	`image_dct_anomaly`	The compression profile suggests the image was saved again. JPEG only.
	`image_ycbcr_seam`	Color anomalies suggest content was spliced in.
Metadata	`image_exif_heavy_editor`	The metadata names a full image editor, such as Adobe Photoshop.
	`image_exif_editing_software`	The metadata names a light editing tool.
	`image_exif_stripped`	The image was re-encoded and has no camera metadata.
	`image_exif_date_anomaly`	The dates in the metadata don't agree.
	`image_exif_gps_present`	The metadata contains GPS coordinates.
AI generation	`image_ai_generated_metadata`	The metadata names an AI image generator.
	`image_ai_generated_indicators`	The image has no metadata at all, which is common in AI-generated images.
	`image_ai_generated_spectral`	The image has frequency patterns typical of AI image generators.
	`image_ai_generated_texture`	The image's noise is unusually uniform.

🚧
There might be erroneous fraud detection
A failed check doesn't prove that a document is fraudulent. Treat the risk level as a signal for review. Genuine documents can trigger checks for reasons like these:

The PDF was exported from a desktop app such as Microsoft Word. This alone gives a medium risk level.

The PDF was compressed, merged, or annotated after it was issued, including with an online tool. This can give a high risk level.

The image was exported, or was sent through an app that removed its metadata. This alone can give a medium risk level.

The scan or image quality is low.

Some finding details mention bank statements or banking software because these checks were first built for bank statements. The checks still apply to other document types.

Errors

Situation	Result
A PDF can't be opened because it's corrupt	Risk Score `100`, Risk Level `critical`, and a `parse_failure` finding.
An image can't be opened	An error is returned with Risk Score `0` and Risk Level `clean`. Treat the image as not analyzed.
A check fails while the others run	The failure is listed in Check Errors. The score doesn't include that check, so a low score may be incomplete.
The file type isn't supported, or the PDF is password-protected	The file isn't analyzed and an error is returned.