Catching edited documents before disbursal

Most document fraud in retail lending is not elaborate. A borrower, or someone helping them, takes a genuine payslip or bank statement and changes a few numbers. The salary goes up. A bounced EMI disappears. A closing balance is rounded upwards. The document still looks like it came from the employer or the bank, because most of it did.

These edits are cheap to make, and an underwriter reading a printout has little chance of seeing them. The useful question is not "does this look real?" but "has this file been changed since it was issued?" That question can often be answered from the file itself.

How documents get altered

The common patterns are familiar to anyone who has worked in credit operations:

• Edited PDFs. A genuine statement or payslip is opened in a PDF editor, a figure is replaced, and the file is saved again. The rest of the document is untouched.
• Reconstructed documents. A payslip or Form 16 is rebuilt from scratch in a word processor or spreadsheet, using a real one as a template, then exported to PDF.
• Spliced pages. Pages from different statements, periods or even different people are combined into one file, so a strong month replaces a weak one.
• Print, edit, scan. The document is printed, altered, and scanned or photographed, which wipes out most of the digital traces an edit would leave.

Each of these leaves different evidence, and each needs a different response.

What checks reveal an edit

A PDF is not just a picture of a page. It carries structure, and that structure records a good deal about how the file was made.

• Revision history. The PDF format allows changes to be appended to a file rather than rewriting it. A file that was issued once and then edited often carries both versions, and the earlier one can be compared with the later.
• Producer and dates. Files record the software that created them and when. A bank statement produced by a consumer PDF editor, or modified well after its issue date, deserves a closer look.
• Fonts and text objects. When a figure is replaced, it is often set in a slightly different font, size or spacing, or placed as a separate text object over the original. These differences are invisible on screen but clear in the file's structure.
• Digital signatures. Where a document is digitally signed, the signature should validate, and it should cover the whole file rather than an earlier revision of it.
• Internal arithmetic. On a bank statement, every line's running balance should follow from the previous balance and the transaction. On a payslip, earnings less deductions should equal net pay. An edited figure usually breaks the arithmetic somewhere else on the page.
• Cross-document consistency. Salary credits on the bank statement should match net pay on the payslips. Income on Form 16 should be consistent with the payslips for the same year. Names and dates should agree across KYC, income and bank documents.

No single check is conclusive. A legitimate file can be re-saved by a well-meaning branch employee, and a careful forger can avoid some traces. What works is combining structural checks with arithmetic and cross-document checks, and showing the reviewer exactly what was found, on which page.

Why a scan must be marked unverified

The print-edit-scan route is the hardest to catch, and this is where many processes go wrong.

A scanned page or a phone photo has none of the structure described above. It is an image. Pixel-level editing can be difficult or impossible to detect reliably, especially after compression. A system that runs its checks, finds nothing, and reports "no tampering detected" is making a claim it cannot support.

The honest answer is "unverified". It tells the reviewer that the document could not be checked, not that it passed. That distinction should carry through to the credit decision. An unverified payslip might be accepted alongside a verified bank statement that confirms the same salary, or the lender might ask for the original PDF, an Account Aggregator fetch or a direct confirmation from the employer. What it should never do is quietly count as verified.

RBI's fraud risk management directions for NBFCs, issued in July 2026, ask for a Board-approved policy that covers prevention and early detection of fraud, and they list forgery through false documents or electronic records as a reportable category. Treating unverifiable documents as unverified, rather than as clean, is a small but concrete part of early detection.

Keep a person in the loop

Tamper checks produce signals, not verdicts. A file re-saved by a scanner app is not fraud. A date mismatch might be a timezone. The right design puts each signal in front of a reviewer with the evidence: this text object was added after the original, on page three, over the closing balance.

The reviewer then decides whether to accept the document, ask for a fresh copy or escalate. That decision, the reason given and the name of the person who made it belong in the loan file's record, so that a later audit can see not just what was flagged but how it was handled.

This is the approach we take in Parse, Inferova's document layer: PDFs edited after issue are flagged with the evidence, and a photo or scan that cannot be verified is marked "unverified", never passed. The reviewer makes the call.

If you would like to see these checks run on your own documents, you can request beta access at inferova.com/demo.

Sources