A forged income document does not announce itself. It looks like a salary slip. It has the right format, the right fonts, the right company logo. What it does not have — because forgeries almost never do — is perfect consistency across every signal the document verification AI checks simultaneously. A real document has 11 signals that align. A forgery almost always fails at least two.
A forged income document does not announce itself. It looks like a salary slip. It has the right format, the right fonts, the right company logo. What it does not have — because forgeries almost never do — is perfect consistency across every signal the document verification AI checks simultaneously. A real document has 11 signals that align. A forgery almost always fails at least two.
Why document forgery is harder to detect than it looks — and easier than forgers believe
Modern forgery tools have made the visual quality of fraudulent documents dramatically better over the last five years. A salary slip produced by a free online template generator is visually indistinguishable from a genuine one — same fonts, same layout, same logo treatment. Manual document reviewers — trained origination officers looking at a screen — catch perhaps 60–70% of high-quality forgeries. They miss the rest because visual review, done at scale and under time pressure, cannot check every signal that digital forensic analysis checks automatically.
The Document Verification Agent AI is not doing a faster version of the same visual check a human does. It is checking a fundamentally different set of signals — metadata, encoding, pixel-level consistency, formatting fingerprints — that are invisible to human visual inspection but are detectable in the digital file in under 30 seconds. Forgeries fail these checks precisely because forgers focus on making documents look right, not on making them have the correct digital properties of the original.
"Forgeries are designed to defeat visual inspection. The Document Verification AI does not do visual inspection — it checks the signals that forgers do not know exist."
The 11 signals — organised by what they detect and how they work
Category A — Digital Integrity Signals
3 signals · Detects: file-level manipulation
01
PDF metadata consistency
Every PDF contains metadata: creation date, creator application, last modified date, and modification history. A genuine salary slip generated by a payroll system shows creation and modification dates that match the document period, created by a payroll software (Greythr, Darwinbox, RazorpayX, SAP). A forged document typically shows creation metadata that postdates the document period, or creator metadata from a design application (Canva, Photoshop, MS Word) rather than a payroll system. The modification history is particularly revealing — a genuine document shows a single creation event; a forged document often shows a creation event followed by modification events where fields were edited.
Flag pattern: creation date within 30 days of submission but doc date is 3 months ago · Creator: "Adobe Illustrator CC" on a salary slip
High
02
Font encoding fingerprint
Genuine documents generated by payroll systems use specific font encoding patterns that are reproducible and consistent across all documents from that payroll system. A salary slip from Greythr always uses the same embedded font metadata, the same character encoding, and the same font rendering. A forged document using a template recreates the visual appearance of the font but uses different encoding metadata — a discrepancy that is invisible visually but detectable at the encoding layer. The Document Verification AI maintains a library of encoding fingerprints for major Indian payroll systems and HR platforms.
Flag: font encoding inconsistent with stated payroll platform · Unicode range mismatch
High
03
Compression and image block patterns
When a document is scanned or photographed and embedded in a PDF, it produces a specific compression pattern in the image blocks. When elements from different source documents are composited — a company logo from one source, salary figures from another — the compression artifacts at the boundaries between elements differ from the surrounding content. The Document Verification AI analyses the JPEG compression block patterns at element boundaries, detecting the "seams" that appear when content from multiple sources is combined in a single document.
Flag: compression artifact discontinuity at salary figure boundaries · Logo sourced from different JPEG compression cycle
High
Category B — Content Consistency Signals
4 signals · Detects: data manipulation within document
04
Mathematical integrity of salary components
A genuine salary slip has internal mathematical consistency: basic + HRA + allowances = gross; gross − deductions = net. Forgers who edit individual figures to inflate income frequently break the arithmetic. The Document Verification AI computes all arithmetic relationships in the document and flags any discrepancy — a gross salary of ₹92,000 with components that sum to ₹84,000 is a forgery indicator, not a formatting variation.
Flag: gross salary does not equal sum of components · TDS deduction inconsistent with income bracket
High
05
Tax deduction consistency with income level
Income tax deductions (TDS) stated on a salary slip must be mathematically consistent with the stated annual income under the applicable tax slab. A salary slip showing a monthly gross of ₹1,20,000 (₹14.4L annual) should show TDS in the range of ₹8,000–₹12,000/month depending on declared investments. TDS of ₹200 on ₹1,20,000 gross is not a tax planning choice — it is an inconsistency that is either an error or a fabrication.
Flag: TDS amount mathematically inconsistent with stated income under current tax slabs
High
06
PF deduction consistency
Provident Fund deductions are mandatory for employees earning up to ₹15,000/month basic salary, and optional above that — but they must follow the statutory formula (12% of basic, up to ₹1,800/month employee contribution for mandatory PF). A salary slip with a basic of ₹40,000 and a PF deduction of ₹500 is either non-PF-covered (a legitimate scenario) or a falsified deduction figure. The Document Verification AI checks PF consistency against the stated basic salary and flags implausible deduction amounts.
Flag: PF amount not consistent with 12% of basic salary for PF-eligible income levels
Medium
07
Allowance structure plausibility for stated role and company
The allowance breakdown on a salary slip — HRA, travel allowance, food coupon, special allowance — should be consistent with the norms for the stated employer type, city tier, and employee role. A junior software engineer at a mid-size IT company in Bengaluru has a recognisable allowance profile. A salary slip showing allowance structures that are more consistent with a CXO-level package (large car allowance, club membership deduction, executive medical) on a claimed junior-level salary is implausible.
Flag: allowance structure inconsistent with stated role level and employer tier · HRA exceeds statutory limit for city
Medium
Category C — Cross-Document Consistency Signals
2 signals · Detects: inconsistencies across submitted document set
08
Salary slip vs bank statement corroboration
The most reliable income verification cross-check: does the amount credited to the bank account each month correspond to the net salary on the salary slip? A ₹6,400 discrepancy between the slip and the bank credit is acceptable (variable pay, overtime, reimbursements). A ₹28,000 monthly discrepancy between the stated net salary and the bank credit is a forgery indicator — one of the two documents has been fabricated. The Document Verification AI computes this reconciliation automatically, flagging any monthly discrepancy above the acceptable tolerance.
Flag: net salary on slip vs bank credit discrepancy >10% for 2+ consecutive months
High
09
Form 16 vs salary slip annual income reconciliation
A borrower who submits both a Form 16 and 3 months of salary slips has provided two independent income records that must reconcile. The annual income implied by the salary slips × 12 should match the gross salary shown in Part B of the Form 16 within a reasonable range (accounting for variable pay). A significant divergence — slips implying ₹14.4L annual but Form 16 showing ₹9.8L — is a forgery signal for the higher-income document.
Flag: annualised salary slip income vs Form 16 gross income divergence >15%
High
Category D — Institutional Authenticity Signals
2 signals · Detects: fraudulent employer or company details
10
Employer GST and CIN verification
Every legitimate employer with more than 5 employees paying above threshold salaries is registered under GST and/or the Companies Act. The Document Verification AI cross-references the employer name and registered address on the salary slip against the GSTIN and MCA (Company/LLP) registrations. A company that appears on a salary slip but has no GST registration, no MCA filing, and no digital footprint is a shell employer — a common instrument in income fabrication fraud.
Flag: employer name not found in GSTIN database or MCA registry · Address on slip does not match registered address
High
11
EPFO employer code and contribution match
For salaried employees, EPFO contributions from the employer should be verifiable against the EPFO member passbook. The employer PF code on the salary slip should be a valid, active EPFO employer registration. The monthly PF contribution shown on the slip should match the actual contribution recorded in the EPFO member passbook for the same period. A salary slip with a PF deduction that does not appear in the actual EPFO account is either a payroll error or a forgery.
Flag: PF deduction on salary slip not reflected in EPFO member passbook · Employer PF code invalid or inactive
High
The verification output: what the Document AI produces in 30 seconds
Document Verification Report — Salary Slip · Application LA-2025-8841
Priya Ramachandran Sharma · TechCorp India Ltd · November 2025 · Verified in 28 seconds
✓Signal 01 · PDF metadata: Created by Greythr payroll system on Nov 1, 2025 — consistent with document period. No modification events after creation.Pass · 98%
✓Signal 02 · Font encoding: Matches Greythr payroll system fingerprint library. Arial and Roboto encoding consistent with platform.Pass · 97%
✓Signal 03 · Compression patterns: Uniform JPEG compression across all content blocks — no compositing artifacts detected at element boundaries.Pass · 96%
✓Signal 04 · Mathematical integrity: Basic ₹52,000 + HRA ₹20,800 + Travel ₹1,600 + Special ₹14,000 = Gross ₹88,400. TDS ₹6,200. Net ₹82,200. All arithmetic consistent.Pass · 100%
✓Signal 05 · TDS consistency: ₹6,200/month TDS on ₹88,400 gross — consistent with ₹10.6L annual income after standard deduction (estimated annualised TDS: ₹74,400).Pass · 99%
✓Signal 06 · PF deduction: Employee PF ₹6,240 = 12% of basic ₹52,000 — statutory formula satisfied.Pass · 100%
✓Signal 07 · Allowance structure: HRA 40% of basic for Bengaluru — consistent with Tier 1 city norms. Travel allowance ₹1,600 within standard range for mid-level IT employee.Pass · 94%
✓Signal 08 · Bank corroboration: HDFC account credit Nov 5, 2025: ₹82,200 — exact match with net salary on slip. Verified across 3 months: within ±₹400 (variable reimbursements).Pass · 99%
✓Signal 09 · Form 16 reconciliation: Annualised slip income ₹10.6L vs Form 16 gross ₹10.42L — 1.7% variance (within 15% threshold, consistent with mid-year pay revision).Pass · 98%
✓Signal 10 · Employer verification: TechCorp India Ltd — GSTIN 29AABCT1234F1Z5 active, registered at Electronics City Bengaluru. CIN U72200KA2014PTC076841 — active.Pass · 100%
⚑Signal 11 · EPFO match: PF contribution ₹6,240 on slip — EPFO passbook shows ₹6,000 for October, ₹6,240 for November. Minor discrepancy in prior month — likely rounding adjustment, not forgery indicator. Flagged for context.Amber · 87%
Overall authenticity score
96.8
Verification verdict
AUTO-PASS
1 amber flag
EPFO rounding — context note
not a rejection trigger
The forgery signatures the AI has learned from confirmed cases
Beyond the 11 structured signals, the Document Verification Agent AI maintains a learning model trained on confirmed forgery cases — documents that were initially submitted as genuine, were later confirmed as forged, and whose digital signatures are now in the model's pattern library. The most common forgery signatures in Indian lending document fraud include: salary slips created in Canva with the creator metadata not scrubbed; bank statements generated using open-source HDFC/SBI statement template repositories circulating on fraudster forums (identifiable by consistent formatting errors that real bank systems do not produce); Form 16 documents where the employer TAN does not match any TRACES filing for the stated assessment year; and company registration documents for non-existent companies whose CIN numbers are algorithmically generated (a pattern detectable because valid CINs follow a specific checksum).
11Signals checked per document — across digital integrity, content consistency, cross-document, and institutional authenticity
28sAverage verification time — all 11 signals computed in parallel, verdict in under 30 seconds
96.8%Average authenticity score on genuine documents — high-confidence auto-pass for the majority
60–70%Manual catch rate for high-quality forgeries — vs near-100% catch rate for digital signal analysis
The forger optimises for human inspection — the Document AI does not do human inspection
Document forgery in Indian lending has become visually sophisticated because forgers have learned what human reviewers check: the layout, the logo, the font, the general look. What they cannot easily replicate is the digital DNA of a genuine document — the metadata fingerprints, the encoding patterns, the compression signatures, and the arithmetic relationships that are invisible to the eye but immediately detectable to an algorithm. The Document Verification AI checks the signals that forgers do not know exist. That is the asymmetry that makes the 11-signal model effective — not because each signal is independently conclusive, but because a genuine document passes all 11 and a forgery almost always fails at least two.
