Document Tampering Detection: How AI Spots Forged Documents

Document fraud is one of the oldest forms of deception. What’s changed is the tooling. AI has made it dramatically easier to produce convincing forged documents — and made automated detection far more necessary.

A fraudulent police report, medical record, repair estimate, or invoice can look indistinguishable from a genuine one when produced with modern tools. Large language models generate text with appropriate terminology and formatting. Image generation tools produce logos, signatures, stamps, and letterheads. Layout tools combine them into documents that pass visual inspection.

This guide explains the main types of document tampering and the detection methods that catch them. For a comparison of automated and traditional review in claims teams, see document forgery detection: AI vs traditional methods.

Types of Document Tampering

1. Fully Generated Documents

What it is: The entire document is created from scratch — content, formatting, logos, signatures — using AI tools. No genuine original exists.

Example: A fraudulent police report for a fictitious accident, generated with an LLM for the text, AI-generated logos for the police department header, and a generated signature for the “filing officer.”

Current capability: GPT-class models, Claude, and Gemini produce text that uses appropriate legal, medical, or technical terminology. Image generation tools produce logos and visual elements. Template-based tools combine them into properly formatted PDFs. The output is often sufficient to pass visual review by someone unfamiliar with the specific issuing authority’s document formatting.

2. Altered Genuine Documents

What it is: A genuine document is modified — changing dates, amounts, names, or other details while retaining the authentic structure, formatting, and most of the original content.

Example: A genuine repair estimate for A$2,000 altered to read A$12,000 by modifying specific text fields in a PDF. The document layout, repair shop logo, and formatting are authentic; only the figures have been changed.

Current capability: PDF editing tools (including free ones) allow text modification in many PDFs. For scanned documents, image editing tools can alter text within the scan. The original document provides authentic context that makes the alteration harder to detect visually.

3. Composite Documents

What it is: Elements from multiple genuine documents are combined to create a new document that didn’t exist as a whole.

Example: A medical report with a genuine hospital letterhead (from one document), genuine formatting (from another), and fabricated clinical content. Each individual element is authentic; the combination is fraudulent.

4. Document Element Fraud

What it is: Specific elements within a document are fabricated or replaced while the document structure remains genuine.

Example: A genuine invoice from a real business, with the amount or line items altered. Or a genuine medical report with the diagnosis or treatment details changed.

Detection Methods

Text Analysis (Industry and Research Context)

Current product scope: deetech does not currently perform AI-generated-text classification. Its document pipeline reads text layers, or uses confidence-gated OCR on scans, only to run deterministic structural and fabrication checks, alongside edit-history, metadata, and pixel-level analysis. The AI-authorship techniques below describe broader industry and research methods.

AI-generated text detection. LLM-generated text has statistical properties that differ from human-written text:

Token probability distributions. LLM output tends to select high-probability tokens, creating text that is statistically “smoother” than human writing. Detection models look for this smoothness.
Perplexity analysis. LLM output typically has lower perplexity (more predictable) than human-written text of the same complexity.
Stylistic consistency. LLM-generated text maintains more consistent style throughout a document than human writing, which naturally varies in formality, sentence structure, and vocabulary.
Factual consistency. LLMs may generate internally consistent text that contains factual errors invisible to someone unfamiliar with the subject matter — incorrect procedure codes, non-existent policy numbers, or formatting that doesn’t match the claimed issuer’s actual standards.

These signals weaken as models improve, and a document can be fraudulent whether or not a language model wrote its text — which is why file-level evidence matters more.

Text modification detection. When genuine text has been altered:

Rendering inconsistencies. Modified text may use slightly different font rendering, character spacing, or line spacing than the surrounding original text.
Copy-paste artifacts. Text pasted from different sources may carry formatting artifacts — different character encoding, invisible formatting marks, or spacing variations.
Linguistic analysis. Altered sections may show different writing style, vocabulary, or technical accuracy than the original text.

Visual Element Analysis

Logo and signature verification. Generated or pasted logos and signatures often have detectable characteristics:

Resolution and rendering. Generated logos may have different resolution, compression, or rendering quality than authentic logos extracted from genuine documents.
Consistency with known templates. If the detection system has access to authentic document templates from the claimed issuer, visual elements can be compared against the known standard.
Generation artifacts. Logos and signatures produced by image generation tools can carry frequency-domain traces similar to other AI-generated images.

Stamp and seal analysis. Genuine stamps, notary seals, and certification marks show physical characteristics (uneven ink distribution, pressure variation) that generated or digitally pasted stamps often lack.

Document Structure Analysis

Layout consistency. Every issuing authority (hospital, police department, repair shop, insurance company) has characteristic document layouts — margins, header placement, font choices, field ordering. Documents that claim to be from a specific issuer but deviate from that issuer’s known layout are suspicious.

Template matching. If a detection system maintains a library of authentic templates, submitted documents can be compared against the expected template for the claimed issuer. Deviations — wrong field order, different logo placement, non-standard formatting — indicate potential forgery.

Cross-field consistency. Within a document, fields should be consistent — dates should be coherent and in the correct format for the jurisdiction, reference numbers should follow the issuer’s numbering scheme, and calculated fields (totals, sub-totals, tax) should be arithmetically correct. These are the kinds of deterministic checks deetech runs on supported documents.

Metadata and File Analysis

PDF metadata. PDF files contain metadata about creation and modification:

Creation date and modification date
Authoring software (Acrobat, Word, browser print-to-PDF, online generators)
Producer and creator fields
Page count and document structure

A document claiming to be a printed police report but created in an online editor yesterday is suspicious. A medical record with a modification date after the claimed filing date warrants scrutiny.

Edit-history analysis. A PDF’s internal structure records much of its history:

Later revisions. Modifications leave traces in the file structure, even when the visual output looks seamless.
Embedded resources. Genuine documents embed resources consistently; edited documents may carry additional resources introduced for the altered content.
Object structure. The internal object hierarchy of a PDF can reveal whether content was added, removed, or modified after initial creation.

Scan analysis. For scanned documents (images of physical documents):

Consistent scan quality. All pages should show similar scanning artifacts if scanned on the same device.
Paper texture. Genuine scans show paper texture and print characteristics that differ from digitally created documents.
Modification over scan. If a scanned document has been digitally modified (text changed after scanning), the modification typically lacks the scan artifacts present in the unmodified areas. Pixel forensics look for exactly these regions on supported scan formats.

Application in Insurance

Insurance claims processing involves extensive documentation:

Document Type	Fraud Risk	Detection Priority
Police reports	Fabrication to support staged accidents	High
Medical records	Fabrication or alteration to inflate injury severity	High
Repair estimates	Amount inflation, fabricated line items	High
Invoices	Fabricated invoices for non-existent work	Medium
Correspondence	Fabricated letters from solicitors or authorities	Medium
Identity documents	Synthetic or altered identity (identity checks need a dedicated identity-verification provider)	High
Photographic evidence	See our image detection content	High

Building Document Detection Capability

Integration Points

Document detection should run at the point where documents enter your system:

Claim submission (web portal, mobile app, email)
Post-submission document upload
Third-party document receipt (from solicitors, medical providers, repair shops)

What to Report

Effective document detection provides:

Overall risk score — a summary of the findings, not a probability that the document is genuine
Specific findings — which elements triggered alerts (structure, edit history, arithmetic, metadata, pixel regions)
Coverage — which checks ran, and which could not run on this file (for example, a low-quality scan)
Comparison data — if template matching was used, how the document compares to the expected template
Audit trail — when the analysis was performed, which analyzer versions ran, and who accessed the result

Accuracy Considerations

Document detection faces the same lab-to-production gap as image detection:

Documents from diverse issuers (thousands of hospitals, police departments, repair shops) vary enormously in format
Scan quality varies from high-resolution to barely legible
Legitimate documents may have unusual formatting (small businesses, foreign documents, handwritten elements)
False positives on legitimate documents from unfamiliar issuers must be minimized

That is why confident, deterministic findings — an arithmetic mismatch, an edit made after the document was supposedly issued — are more useful to investigators than a single opaque score.

deetech™ analyzes supported documents submitted with insurance claims using deterministic structural and fabrication checks, edit-history and metadata analysis, confidence-gated OCR, and pixel forensics on supported scans. Findings are for human review; deetech does not classify document text as AI-generated or verify anyone’s identity. Request a demo to see it on your claims documents.