How AI fakes documents — and how to catch it

Last updated: 2026-07-09

For most of the past decade, spotting a forged document was a matter of looking carefully. Amateur fakes had uneven fonts, wrong logos, or balance columns that didn't add up. A trained eye, a few minutes, and a calculator were usually enough.

Generative AI has changed that baseline. A forger no longer needs design skills or patience — only a prompt and a few seconds. The result is a document that looks, at first glance and often at second glance, exactly like the real thing. Understanding how these fakes are made is the first step to catching them.

What AI can and can't fake yet

Modern language and image models can reproduce the visual structure of a bank statement, invoice or payslip with high fidelity. They get logos roughly right, generate plausible transaction rows, and maintain consistent number formatting. What they cannot reliably do — yet — is reproduce the exact internal structure of a real bank's PDF output.

A genuine PDF generated by a bank's core banking system carries a specific software fingerprint: the Producer and Creator fields in the metadata, the way fonts are embedded, the object tree layout, and the compression settings all reflect that bank's particular software stack. AI-generated documents are typically created by a language model rendering to a generic PDF library, which leaves its own set of fingerprints.

Why surface appearance is no longer evidence

The central problem is that visual inspection has always been a shortcut, not a method. It worked well enough when faking a document was difficult. Now that it's easy, appearance tells you almost nothing about authenticity.

A document that looks perfect can still be fraudulent. Conversely, a document with a minor formatting quirk might be entirely genuine — banks update their templates, users print and re-scan, and different branches use slightly different software versions. Relying on appearance alone means you're judging a forgery contest by the forgery's own terms. The verification guides on this site all make the same point: look at the metadata and the structure, not the surface.

Checks that still work

Metadata and software traces. AI tools that generate PDFs usually leave a recognizable Producer field — a Python library, a headless browser renderer, or a generic PDF toolkit. Open the file properties and compare the Producer and Creator fields against what you'd expect from the bank. A statement supposedly from a major Polish or Ukrainian bank should name that bank's system, not a generic library. See the full metadata guide for how to read these fields.

Modification and creation timestamps. AI-generated documents are created at the moment of generation, so the creation timestamp may post-date the statement period it purports to cover. An AI-created "January statement" produced in April will show an April creation date — unless the forger has manually edited the metadata, which itself leaves traces in the object stream.

Font fingerprints. Banks embed specific, licensed fonts in their PDFs. An AI-generated document uses whatever fonts the rendering engine has available, which are rarely the same. At high zoom, the letterforms in an AI fake may differ subtly from the real thing. More reliably, a forensic tool can read the embedded font tables directly and compare them against known-genuine files from the same bank.

Mathematical consistency. AI models can introduce plausible-looking but arithmetically wrong numbers. Check that opening balance + credits − debits = closing balance. Check that invoice line items sum to the stated total, and that VAT is applied at the stated rate. See the guide on spotting a fake invoice for how this check applies to invoices.

Cross-referencing against a reference template is the most reliable check. If you hold a genuine statement from the same bank and the same period, a careful side-by-side comparison of the PDF object structure — not just the appearance — will surface discrepancies an AI fake cannot hide.

The arms race: detectors versus generators

AI-detection tools that look for statistical patterns in generated text or image content are improving, but so are the generators. A detector trained on one generation of models may not catch the next. This is not a reason to abandon detection — it's a reason not to rely on any single method.

The more durable approach is to check properties that generators have structural difficulty faking: the internal object layout of a PDF generated by a specific bank's software, the exact font embedding and compression parameters, and the metadata streams that a generic PDF library cannot accurately replicate without knowing the bank's precise software configuration.

Forensic verification of the file itself

The most robust defense against AI-generated document fraud is to stop looking at the picture and read the file. Forensic analysis examines the document's internal structure — the PDF object tree, incremental update history, font embedding tables and metadata streams — and asks whether it holds together: whether one generator produced it in a single pass, whether anything was written over it afterwards, whether the numbers on the page agree with each other. An AI-generated document can look perfect visually and still fall apart in a dozen structural ways.

The method is universal: examining the object tree for edit layers, cross-checking font tables, and flagging anomalies in the creation and modification history. Nothing depends on us holding a template for the issuing institution, so a statement from a small regional bank is read exactly as closely as one from a household name. The result carries a confidence score and a summary of what was and was not consistent with a genuine document.

What this means for lenders and landlords

Anyone who makes a financial decision based on a document — approving a loan, signing a lease, releasing goods — is now operating in an environment where a polished forgery takes seconds to produce. The practical response is to build document verification into the process, not treat it as an optional extra for suspicious cases. Lenders and landlords who verify routinely have a structural advantage: they catch fraud early, before the loss, and they reduce the incentive for applicants to try.

Your documents are handled under strict security and GDPR protocols and deleted after review. Verification is not a sign of distrust toward an applicant — it's a standard part of responsible due diligence.

Frequently asked questions.

Can AI-generated fake documents be detected?

Yes. Generative tools reproduce how a document looks, not where it came from. Internal PDF structure, generator fingerprints and edit traces still give fakes away under forensic analysis.

Why is visual inspection no longer enough?

Because AI produces correct logos, plausible numbers and clean layouts in seconds. Surface appearance no longer separates real from fake — the evidence sits in metadata, object structure and cross-checks a viewer never displays.

Which checks still work against AI forgeries?

Checks anchored outside the image: PDF metadata and edit history, balance maths, consistency between the file's structure and the software it claims to come from, and independent confirmation — calling the employer, checking the register, waiting for the money to clear.