Document Forgery

What Is Document Forgery?

Document forgery is the creation, alteration or misuse of a document so that it misrepresents who someone is, what a company is or what a transaction involves. In financial services, the documents most often targeted are identity documents such as passports, national ID cards and driving licenses, along with proof of address, bank statements, payslips, company registration certificates, articles of association and trade documents such as invoices and bills of lading.

Fraud teams usually distinguish between several categories:

• Counterfeit documents: produced from scratch to imitate a genuine document type.
• Forged or altered documents: genuine documents whose data has been changed, for example a new photo, name or date of birth.
• Fraudulently obtained genuine documents: real documents issued by the proper authority on the basis of false supporting information.
• Stolen blank documents: genuine blanks filled in by criminals.
• Impostor use: a genuine, unaltered document used by someone who looks similar to the rightful holder.
• Digitally manipulated images: photos or scans of documents edited with software, or entirely generated, which are then uploaded during remote onboarding.

Why Document Forgery Matters

Identity verification at onboarding relies heavily on documents. If a forged document is accepted, every downstream control, from sanctions screening to transaction monitoring, is applied to a false identity.

Forged documents enable:

• Opening accounts for money mules and fraud rings
• Synthetic identity fraud, where invented personal details are backed by fake papers
• Evasion of sanctions and PEP screening by presenting a different name or date of birth
• Corporate fraud through fake incorporation documents that hide the real beneficial owner
• Loan, credit and benefit fraud based on falsified income or address evidence

The shift to remote onboarding has increased the risk, because the firm sees an image of the document rather than the physical item, and many physical security features cannot be checked from a photo.

How Forgery Is Detected

Visual and Structural Checks

Detection usually combines several layers:

1. Template comparison: checking that the layout, fonts, field positions and background patterns match the known template for that document type and issuing country.
2. Machine readable zone (MRZ) validation: the MRZ on passports and many ID cards follows the ICAO Doc 9303 specification, including check digits. Data that fails the check digit calculation, or that does not match the printed visual zone, is a strong warning sign.
3. OCR consistency checks: extracting text with optical character recognition and comparing fields against each other and against data the applicant entered.
4. Image forensics and texture analysis: looking for signs of editing such as inconsistent compression, pixel-level artifacts around altered fields, mismatched lighting, or a photo that sits on top of rather than within the document.
5. Security feature checks: holograms, optically variable ink, microprinting and guilloche patterns, where image quality allows them to be assessed.

Chip Verification

Many modern passports and ID cards contain a contactless chip. Under ICAO Doc 9303, the data on the chip is digitally signed by the issuing state. Reading the chip and validating that signature confirms that the data was written by the issuer and has not been altered, which is far stronger evidence than visual checks alone. Comparing the chip photo with the printed photo and with a live selfie adds a further layer.

Linking the Document to the Person

A genuine document is not enough if the person presenting it is not its owner. Biometric verification and liveness detection check that the applicant is physically present and matches the document photo.

Red Flags

• MRZ check digits that fail, or MRZ data that differs from the visual zone
• Fonts, spacing or alignment that do not match the official template
• Signs of cropping, blurring or retouching around the photo or key fields
• A document image with no natural glare, depth or edges, suggesting a screen capture or generated image
• The same document image or photo appearing across multiple applications
• Expiry dates, issue dates and ages that are inconsistent with each other
• Supporting documents with mismatched fonts, round-number balances or metadata showing recent editing

Regulatory Expectations

FATF Recommendation 10 requires financial institutions to identify customers and verify that identity using reliable, independent source documents, data or information. In the EU, Directive (EU) 2015/849 and the AML Regulation (EU) 2024/1624 set out customer due diligence obligations, including verification on the basis of reliable and independent sources. In the UK, the Money Laundering Regulations 2017 require verification of identity on the basis of documents or information obtained from a reliable source independent of the customer. Regulators generally expect firms that onboard remotely to address the additional risk of document fraud that comes with non-face-to-face verification.

Best Practices

• Combine multiple independent checks rather than relying on any single signal.
• Read and validate the chip wherever the document has one and the customer's device supports it.
• Keep fraud-detection rules and models current as forgery techniques evolve.
• Feed confirmed forgeries back into internal lists so repeat attempts are caught.
• Route uncertain results to trained reviewers rather than auto-approving or auto-rejecting.

How on8.ai Helps

Passporter, which is in development, reads and verifies ID documents and checks e-passport chips to ICAO 9303. Document images are processed by on8.ai's own models and are not sent to the cloud. Before an applicant reaches document checks, Pre-KYC checks on email, phone, IP risk, velocity and bots can filter out many fraudulent sessions.

Related Terms

• Identity Spoofing
• Synthetic Identity Fraud
• Liveness Detection
• Biometric Verification
• KYC (Know Your Customer)