Every couple of weeks, I see a photo of a fake receipt or paystub flash across my LinkedIn feed. The document looks authentic, complete with coffee stains, weathered texture, and creases. These synthetic documents should spark lender concern. Thousands of paystub generation sites are now available on the Internet.
Fraudsters can now quickly generate a false paper trail of income. These synthetically generated-documents can be sophisticated, lacking many of the tell-tale signs of visible manipulation fraud analysts have historically used to detect fakes: low-quality watermarks, inconsistent formatting and fonts, typos like substituting the letter “o” for a zero, distorted photos, or missing fields.
So how do lenders combat this new threat of document fraud? Fortunately for businesses that rely on proof of income, income documents do not operate in a vacuum. They exist in an ecosystem where they leave traces of informational residue.
Have you ever walked alone on a quiet beach, and looked back at the footprints you left behind in the sand? Just like people, documents leave their own footprints. A key weapon against a synthetic document is to compare the image to a truth set of real-world documents used in actual commerce.
Understanding the Architecture of Legitimate Bank Statements and Pay Stubs
Each bank statement and employer paystub has its own bespoke format that can be understood if sufficient examples are available. Consider a bank statement from Acme Bank. It will use a standard letterhead and template. It will have a designated place for signatures and for reporting transactions and for customer identifying information. Acme will leverage specific codes to identify an account or a particular transaction.
Similarly, paystubs have uniquely identifiable features. When there is sufficient data available, one can know the payroll provider an employer uses and how the employer has customized their statement. For example, one can identify the benefits provided for full-time employees, the pay frequency, and the format of the statement right down to the pixel, and how these configurations change over time. And because paystubs are constantly being used, if the organization modifies the paystub, this change can be caught in near real time. Here is an example of a fraudulent pay statement where the font deviates from the ADP standard format.
Tracking the Consumer Behavior in Documents
The transaction behavior in paystubs and bank statements similarly reveal identifiable residue. An authentic bank statement lists a consumer’s actual deposits and withdrawals (including checks and debit payments) for a designated period. Fraud prevention solutions which have access to transaction history, can tell if the document is a copy of a previous statement or reflects other types of indicia of fraud. For example, below is an image from a bank statement where two different people have the same account number.
Yes, fake documents are getting more sophisticated. But, with access to a deep understanding of the document ecosystem, companies can counteract document fraud.
Catching Document Fraud with Informed Defender
At Informed, we built Informed Defender to spot the hidden signals of fraud that human eyes often miss. Using advanced AI agents, Defender flags anomalies like font changes, recycled templates, altered transactions, and metadata inconsistencies—helping lenders detect document fraud early, protect their portfolios, and approve legitimate borrowers with confidence.
